CVE-2011-2107
published 2011-06-09CVE-2011-2107: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on…
PriorityP274medium4.3CVSS 2.0
AVNACMAuNCNIPAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
3.55%
87.9th percentile
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."
Affected
128 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | <= 10.0.3 | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat | — | — |
| adobe | acrobat_reader | <= 10.0.3 | — |
| adobe | acrobat_reader | — | — |
| adobe | acrobat_reader | — | — |
| adobe | acrobat_reader | — | — |
| adobe | acrobat_reader | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is being actively exploited in the wild via targeted attacks; attack vector is a malicious link delivered in an email message that the user is tricked into clicking. ↗
- →The universal XSS vulnerability allows an attacker to take actions on a user's behalf on any website or webmail provider when the user visits a malicious website; monitor for anomalous cross-origin Flash-initiated requests. ↗
- ·Affected versions: Adobe Flash Player 10.3.181.16 and earlier on Windows, Macintosh, Linux, and Solaris; Flash Player 10.3.185.22 and earlier on Android. Fixed version is 10.3.181.22 (desktop) / post-10.3.185.22 (Android). ↗
- ·Adobe Reader for Linux also affected, but the support model changed to only two updates per year; Flash Player is no longer bundled in Adobe Reader 9.4.6 for Unix, so future Flash flaws will not apply to it. ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck4.3MEDIUM
vendor_redhat4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rr7r-vwxf-ff4c: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10
ghsa_unreviewed·2022-05-14
CVE-2011-2107 [MEDIUM] CWE-79 GHSA-rr7r-vwxf-ff4c: Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."
VulnCheck
Adobe Flash Player Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2011·CVSS 4.3
CVE-2011-2107 [MEDIUM] Adobe Flash Player Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Adobe Flash Player Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."
Affected: Adobe Flash Player
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.cnet.com/news/privacy/adobe-issues-fix-for-flash-hole-being-used-in-attacks/
Red Hat
flash-plugin: Cross-site scripting vulnerability (APSB11-13)
vendor_redhat·2011-06-05·CVSS 4.3
CVE-2011-2107 [MEDIUM] CWE-79 flash-plugin: Cross-site scripting vulnerability (APSB11-13)
flash-plugin: Cross-site scripting vulnerability (APSB11-13)
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2011/06/stable-channel-update.htmlhttp://secunia.com/advisories/44846http://secunia.com/advisories/44847http://secunia.com/advisories/44871http://secunia.com/advisories/44872http://secunia.com/advisories/44946http://secunia.com/advisories/48308http://www.adobe.com/support/security/bulletins/apsb11-13.htmlhttp://www.blackberry.com/btsc/KB27240http://www.redhat.com/support/errata/RHSA-2011-0850.htmlhttp://www.securityfocus.com/bid/48107http://www.securitytracker.com/id?1025603http://www.securitytracker.com/id?1025658https://exchange.xforce.ibmcloud.com/vulnerabilities/67838https://hermes.opensuse.org/messages/8704566https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13762http://googlechromereleases.blogspot.com/2011/06/stable-channel-update.htmlhttp://secunia.com/advisories/44846http://secunia.com/advisories/44847http://secunia.com/advisories/44871http://secunia.com/advisories/44872http://secunia.com/advisories/44946http://secunia.com/advisories/48308http://www.adobe.com/support/security/bulletins/apsb11-13.htmlhttp://www.blackberry.com/btsc/KB27240http://www.redhat.com/support/errata/RHSA-2011-0850.htmlhttp://www.securityfocus.com/bid/48107http://www.securitytracker.com/id?1025603http://www.securitytracker.com/id?1025658https://exchange.xforce.ibmcloud.com/vulnerabilities/67838https://hermes.opensuse.org/messages/8704566https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13762
2011-06-09
Published
Exploited in the wild