CVE-2008-0454

Severity Score

6.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."

Vulnerabilidad de secuencias de comandos en zonas cruzadas en el control web Internet Explorer de Skype 3.6.0.244, y versiones anteriores 3.5.x y 3.6.x en Windows, permite a atacantes remotos con la complicidad del usuario inyectar secuencias de comandos web o HTML de su elección en la Zona de Máquina Local mediante el campo Title de un (1) Dailymotion y posiblemente (2) una película Metacafe en la galería de vídeos de Skype, accesible a través de una búsqueda dentro del diálogo "Add video to chat", también conocido como "videomood XSS".

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-01-24 CVE Reserved
2008-01-25 CVE Published
2024-08-07 CVE Updated
2025-06-10 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (13)

URL	Tag	Source
http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html	Mailing List
http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html	Mailing List
http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx	X_refsource_misc
http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html	X_refsource_confirm
http://skype.com/security/skype-sb-2008-001-update1.html	X_refsource_confirm
http://skype.com/security/skype-sb-2008-001.html	X_refsource_confirm
http://www.critical.lt/?opinions/show/1470	X_refsource_misc
http://www.gnucitizen.org/blog/vulnerabilities-in-skype	X_refsource_misc
http://www.kb.cert.org/vuls/id/248184	Third Party Advisory
http://www.securityfocus.com/archive/1/486512/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/27338	Vdb Entry
http://www.vupen.com/english/advisories/2008/0194	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/39754	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"	Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"	*	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe
Skype Technologies Search vendor "Skype Technologies"	Skype Search vendor "Skype Technologies" for product "Skype"	<= 3.6.0.244 Search vendor "Skype Technologies" for product "Skype" and version " <= 3.6.0.244"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe
Skype Technologies Search vendor "Skype Technologies"	Skype Search vendor "Skype Technologies" for product "Skype"	3.5 Search vendor "Skype Technologies" for product "Skype" and version "3.5"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe
Skype Technologies Search vendor "Skype Technologies"	Skype Search vendor "Skype Technologies" for product "Skype"	3.6 Search vendor "Skype Technologies" for product "Skype" and version "3.6"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe