Vulnerability Name:

CVE-2008-3567 (CCN-44207)

Assigned:2008-08-04
Published:2008-08-04
Updated:2017-09-29
Summary:Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Other
References:Source: MISC
Type: UNKNOWN
http://blog.watchfire.com/wfblog/2008/09/winamp-nowplayi.html

Source: MITRE
Type: CNA
CVE-2008-3567

Source: CCN
Type: Winamp Forums, 08-04-2008
Winamp 5.541 Released

Source: CONFIRM
Type: Patch
http://forums.winamp.com/showthread.php?threadid=295505

Source: CCN
Type: SA31371
Winamp "NowPlaying" Unspecified Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
31371

Source: CCN
Type: OSVDB ID: 47347
Winamp NowPlaying Feature Media File Metadata XSS

Source: BID
Type: Patch
30539

Source: CCN
Type: BID-30539
Winamp 'NowPlaying' MP3 Tag Cross-Site Scripting Vulnerability

Source: CCN
Type: Winamp Web site
Download Winamp Media Player

Source: XF
Type: UNKNOWN
winamp-nowplaying-unspecified(44207)

Source: XF
Type: UNKNOWN
winamp-nowplaying-unspecified(44207)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:15716

Vulnerable Configuration:Configuration 1:
  • cpe:/a:nullsoft:winamp:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.5e:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.6x:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.7x:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.10:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.24:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.50:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.60:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.61:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.62:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.64:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.65:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.70:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.71:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.72:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.73:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.74:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.75:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.76:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.77:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.78:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.79:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.80:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.81:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.90:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.91:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.95:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.01:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.02:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.03:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.3:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.03a:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.04:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.05:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.5:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.06:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.07:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08c:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08d:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08e:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.09:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.11:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.12:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.13:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.21:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.22:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.23:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.24:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.31:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.32:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.33:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.34:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.35:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.36:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.51:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.52:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.53:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:*:*:*:*:*:*:*:* (Version <= 5.54)
  • OR cpe:/a:nullsoft:winamp:5.091:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.093:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.094:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.111:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.112:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nullsoft:winamp:2.10:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.79:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.80:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.76:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.77:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.78:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.81:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.91:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.02:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.05:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.07:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.09:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.091:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.12:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.11:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.094:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.24:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.33:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.3:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.35:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.32:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.21:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.5:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.51:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.01:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.03:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.04:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.06:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.093:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.111:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.112:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.13:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.22:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.23:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.24:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.50:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.60:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.61:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.62:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.64:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.65:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.70:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.71:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.72:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.73:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.74:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.75:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.90:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:2.95:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.31:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.34:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.36:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.52:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.53:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.54:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08e:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08d:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.08c:*:*:*:*:*:*:*
  • OR cpe:/a:nullsoft:winamp:5.03a:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:15716
    V
    		Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541
    2014-04-07
    BACK
    nullsoft winamp 2.0
    nullsoft winamp 2.4
    nullsoft winamp 2.5e
    nullsoft winamp 2.6x
    nullsoft winamp 2.7x
    nullsoft winamp 2.10
    nullsoft winamp 2.24
    nullsoft winamp 2.50
    nullsoft winamp 2.60
    nullsoft winamp 2.61
    nullsoft winamp 2.62
    nullsoft winamp 2.64
    nullsoft winamp 2.65
    nullsoft winamp 2.70
    nullsoft winamp 2.71
    nullsoft winamp 2.72
    nullsoft winamp 2.73
    nullsoft winamp 2.74
    nullsoft winamp 2.75
    nullsoft winamp 2.76
    nullsoft winamp 2.77
    nullsoft winamp 2.78
    nullsoft winamp 2.79
    nullsoft winamp 2.80
    nullsoft winamp 2.81
    nullsoft winamp 2.90
    nullsoft winamp 2.91
    nullsoft winamp 2.95
    nullsoft winamp 3.0
    nullsoft winamp 3.1
    nullsoft winamp 5.0
    nullsoft winamp 5.0.1
    nullsoft winamp 5.0.2
    nullsoft winamp 5.01
    nullsoft winamp 5.1
    nullsoft winamp 5.02
    nullsoft winamp 5.2
    nullsoft winamp 5.03
    nullsoft winamp 5.3
    nullsoft winamp 5.03a
    nullsoft winamp 5.04
    nullsoft winamp 5.05
    nullsoft winamp 5.5
    nullsoft winamp 5.06
    nullsoft winamp 5.07
    nullsoft winamp 5.08
    nullsoft winamp 5.08c
    nullsoft winamp 5.08d
    nullsoft winamp 5.08e
    nullsoft winamp 5.09
    nullsoft winamp 5.11
    nullsoft winamp 5.12
    nullsoft winamp 5.13
    nullsoft winamp 5.21
    nullsoft winamp 5.22
    nullsoft winamp 5.23
    nullsoft winamp 5.24
    nullsoft winamp 5.31
    nullsoft winamp 5.32
    nullsoft winamp 5.33
    nullsoft winamp 5.34
    nullsoft winamp 5.35
    nullsoft winamp 5.36
    nullsoft winamp 5.51
    nullsoft winamp 5.52
    nullsoft winamp 5.53
    nullsoft winamp *
    nullsoft winamp 5.091
    nullsoft winamp 5.093
    nullsoft winamp 5.094
    nullsoft winamp 5.111
    nullsoft winamp 5.112
    nullsoft winamp 2.10
    nullsoft winamp 2.79
    nullsoft winamp 2.80
    nullsoft winamp 2.76
    nullsoft winamp 2.77
    nullsoft winamp 2.78
    nullsoft winamp 2.81
    nullsoft winamp 3.0
    nullsoft winamp 2.91
    nullsoft winamp 5.02
    nullsoft winamp 5.05
    nullsoft winamp 5.07
    nullsoft winamp 5.09
    nullsoft winamp 5.091
    nullsoft winamp 5.12
    nullsoft winamp 5.11
    nullsoft winamp 5.094
    nullsoft winamp 5.24
    nullsoft winamp 5.33
    nullsoft winamp 5.3
    nullsoft winamp 5.35
    nullsoft winamp 5.32
    nullsoft winamp 5.21
    nullsoft winamp 5.5
    nullsoft winamp 5.51
    nullsoft winamp 5.0
    nullsoft winamp 5.01
    nullsoft winamp 5.03
    nullsoft winamp 5.04
    nullsoft winamp 5.06
    nullsoft winamp 5.093
    nullsoft winamp 5.1
    nullsoft winamp 5.111
    nullsoft winamp 5.112
    nullsoft winamp 5.13
    nullsoft winamp 5.2
    nullsoft winamp 5.22
    nullsoft winamp 5.23
    nullsoft winamp 2.0
    nullsoft winamp 2.24
    nullsoft winamp 2.4
    nullsoft winamp 2.50
    nullsoft winamp 2.60
    nullsoft winamp 2.61
    nullsoft winamp 2.62
    nullsoft winamp 2.64
    nullsoft winamp 2.65
    nullsoft winamp 2.70
    nullsoft winamp 2.71
    nullsoft winamp 2.72
    nullsoft winamp 2.73
    nullsoft winamp 2.74
    nullsoft winamp 2.75
    nullsoft winamp 2.90
    nullsoft winamp 2.95
    nullsoft winamp 3.1
    nullsoft winamp 5.0.1
    nullsoft winamp 5.0.2
    nullsoft winamp 5.08
    nullsoft winamp 5.31
    nullsoft winamp 5.34
    nullsoft winamp 5.36
    nullsoft winamp 5.52
    nullsoft winamp 5.53
    nullsoft winamp 5.54
    nullsoft winamp 5.08e
    nullsoft winamp 5.08d
    nullsoft winamp 5.08c
    nullsoft winamp 5.03a