CVE-2008-2640 Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject ar...
MediumCVSS 4.3
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/. NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flex | = 3.0.1 | No fix listed |
| Adobe flex builder | = 3 | No fix listed |
References
- blog.watchfire.com exploit
- 30746 patch third-party-advisory vendor-advisory
- 1020301 vdb-entry
- www.adobe.com patch
- 29778 patch vdb-entry
- ADV-2008-1862 vdb-entry
- adobeflex-historymanagement-xss(43150) vdb-entry