CVE-2008-4401
published 2008-10-17CVE-2008-4401: ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the…
PriorityP343critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
7.15%
93.6th percentile
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | <= 9.0.124.0 | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x362-hgrj-5pw9: ActionScript in Adobe Flash Player 9
ghsa_unreviewed·2022-05-02
CVE-2008-4401 [HIGH] GHSA-x362-hgrj-5pw9: ActionScript in Adobe Flash Player 9
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
Red Hat
flash-plugin: upload/download user interaction
vendor_redhat·2008-10-15·CVSS 10.0
CVE-2008-4401 [CRITICAL] flash-plugin: upload/download user interaction
flash-plugin: upload/download user interaction
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.htmlhttp://secunia.com/advisories/32270http://secunia.com/advisories/32448http://secunia.com/advisories/32702http://secunia.com/advisories/32759http://secunia.com/advisories/33390http://secunia.com/advisories/34226http://security.gentoo.org/glsa/glsa-200903-23.xmlhttp://securitytracker.com/id?1021061http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1http://support.avaya.com/elmodocs2/security/ASA-2008-440.htmhttp://support.avaya.com/elmodocs2/security/ASA-2009-020.htmhttp://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.htmlhttp://www.adobe.com/support/security/bulletins/apsb08-18.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0945.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0980.htmlhttp://www.vupen.com/english/advisories/2008/2838https://exchange.xforce.ibmcloud.com/vulnerabilities/45913http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.htmlhttp://secunia.com/advisories/32270http://secunia.com/advisories/32448http://secunia.com/advisories/32702http://secunia.com/advisories/32759http://secunia.com/advisories/33390http://secunia.com/advisories/34226http://security.gentoo.org/glsa/glsa-200903-23.xmlhttp://securitytracker.com/id?1021061http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1http://support.avaya.com/elmodocs2/security/ASA-2008-440.htmhttp://support.avaya.com/elmodocs2/security/ASA-2009-020.htmhttp://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.htmlhttp://www.adobe.com/support/security/bulletins/apsb08-18.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0945.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0980.htmlhttp://www.vupen.com/english/advisories/2008/2838https://exchange.xforce.ibmcloud.com/vulnerabilities/45913
2008-10-17
Published