CVE-2008-6062

Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Insert Flash Video feature is used, allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName parameter. NOTE: this may overlap CVE-2007-6242, CVE-2007-6244, or CVE-2007-6637.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw
http://www.adobe.com/support/security/bulletins/apsb07-20.html	Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/249337	US Government Resource
http://www.securityfocus.com/archive/1/485722/100/100/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:dreamweaver:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2009-02-05 01:30

Updated : 2024-02-04 17:33

NVD link : CVE-2008-6062

Mitre link : CVE-2008-6062

CVE.ORG link : CVE-2008-6062

JSON object : View

Products Affected

adobe

dreamweaver

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2008-6062", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-02-05T01:30:00.313", "references": [{"url": "http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw", "source": "cve@mitre.org"}, {"url": "http://www.adobe.com/support/security/bulletins/apsb07-20.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/249337", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/485722/100/100/threaded", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Insert Flash Video feature is used, allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName parameter. NOTE: this may overlap CVE-2007-6242, CVE-2007-6244, or CVE-2007-6637."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en ActionScript en ficheros arbitrarios Shockwave Flash (SWF) creados por Adobe Dreamweaver, cuando se usa la caracter\u00edstica Insert Flash Video, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elecci\u00f3n a trav\u00e9s una funci\u00f3n as: URI en el par\u00e1metro skinName. NOTA: deber\u00eda sobreescribir las vulnerabilidades CVE-2007-6242, CVE-2007-6244, or CVE-2007-6637."}], "lastModified": "2018-10-11T20:56:57.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:dreamweaver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4612B738-830D-417F-BD8B-7AA15010F193"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}