CVE-2008-4401

flash-plugin: upload/download user interaction

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.

ActionScript en Adobe Flash Player 9.0.124.0 y anteriores no requiere interacción del usuario en conjunción con (1) la operación FileReference.browse en la API de subida FileReference upload o (2) la operación FileReference.download en la API de descarga FileReference, lo que permite a atacantes remotos crear un cuadro de diálogo de exploración y ,posiblemente tener otro impacto no especificado, mediante un fichero SWF.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-10-02 CVE Reserved
2008-10-17 CVE Published
2024-08-07 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (20)

URL	Tag	Source
http://secunia.com/advisories/32448	Third Party Advisory
http://secunia.com/advisories/32702	Third Party Advisory
http://secunia.com/advisories/32759	Third Party Advisory
http://secunia.com/advisories/33390	Third Party Advisory
http://secunia.com/advisories/34226	Third Party Advisory
http://securitytracker.com/id?1021061	Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm	X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm	X_refsource_confirm
http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html	X_refsource_confirm
http://www.vupen.com/english/advisories/2008/2838	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45913	Vdb Entry

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/32270	2018-10-30
http://www.adobe.com/support/security/bulletins/apsb08-18.html	2018-10-30

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html	2018-10-30
http://security.gentoo.org/glsa/glsa-200903-23.xml	2018-10-30
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1	2018-10-30
http://www.redhat.com/support/errata/RHSA-2008-0945.html	2018-10-30
http://www.redhat.com/support/errata/RHSA-2008-0980.html	2018-10-30
https://access.redhat.com/security/cve/CVE-2008-4401	2008-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=466154	2008-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				<= 9.0.124.0 Search vendor "Adobe" for product "Flash Player" and version " <= 9.0.124.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0 Search vendor "Adobe" for product "Flash Player" and version "7.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0.1 Search vendor "Adobe" for product "Flash Player" and version "7.0.1"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0.25 Search vendor "Adobe" for product "Flash Player" and version "7.0.25"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0.63 Search vendor "Adobe" for product "Flash Player" and version "7.0.63"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0.69.0 Search vendor "Adobe" for product "Flash Player" and version "7.0.69.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0.70.0 Search vendor "Adobe" for product "Flash Player" and version "7.0.70.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.0_r67 Search vendor "Adobe" for product "Flash Player" and version "7.0_r67"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.1 Search vendor "Adobe" for product "Flash Player" and version "7.1"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.1.1 Search vendor "Adobe" for product "Flash Player" and version "7.1.1"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				7.2 Search vendor "Adobe" for product "Flash Player" and version "7.2"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				8.0 Search vendor "Adobe" for product "Flash Player" and version "8.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				8.0.24.0 Search vendor "Adobe" for product "Flash Player" and version "8.0.24.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				8.0.34.0 Search vendor "Adobe" for product "Flash Player" and version "8.0.34.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				8.0.35.0 Search vendor "Adobe" for product "Flash Player" and version "8.0.35.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				8.0.39.0 Search vendor "Adobe" for product "Flash Player" and version "8.0.39.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				9.0 Search vendor "Adobe" for product "Flash Player" and version "9.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				9.0.112.0 Search vendor "Adobe" for product "Flash Player" and version "9.0.112.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				9.0.114.0 Search vendor "Adobe" for product "Flash Player" and version "9.0.114.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				9.0.115.0 Search vendor "Adobe" for product "Flash Player" and version "9.0.115.0"		-		Affected