Unscored severity · published Jun 18, 2008
CVE-2008-2640
Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote…
–
CVSS
2.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/. NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flex · Adobe
3.0.1 · source: NVD
FB
Flex Builder · Adobe
3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2640
Exploit
http://blog.watchfire.com/wfblog/2008/06/javascript-code.html
Patch
http://secunia.com/advisories/30746
securitytracker.com
http://securitytracker.com/id?1020301
Patch
http://www.adobe.com/support/security/bulletins/apsb08-14.html
Patch
http://www.securityfocus.com/bid/29778
www.vupen.com
http://www.vupen.com/english/advisories/2008/1862
More from Flex
–
CVE-2009-1870
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to obtain sensitive information via vectors involving saving an SWF…
–
CVE-2009-1869
Integer overflow in the ActionScript Virtual Machine 2 (AVM2) abcFile parser in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows…
–
CVE-2009-1868
Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service…
–
CVE-2009-1867
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog,…
–
CVE-2009-1866
Stack-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service…