Vulnerability Name:

CVE-2008-4823 (CCN-46536)

Assigned:2008-11-05
Published:2008-11-05
Updated:2018-10-30
Summary:Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-4823

Source: APPLE
Type: UNKNOWN
APPLE-SA-2008-12-15

Source: CCN
Type: RHSA-2008-0945
Important: flash-plugin security update

Source: CCN
Type: RHSA-2008-0980
Important: flash-plugin security update

Source: SECUNIA
Type: UNKNOWN
32702

Source: CCN
Type: SA33179
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
33179

Source: SECUNIA
Type: UNKNOWN
33390

Source: SECUNIA
Type: UNKNOWN
34226

Source: GENTOO
Type: UNKNOWN
GLSA-200903-23

Source: CCN
Type: SECTRACK ID: 1021151
Adobe Flash Player Input Validation Hole Permits HTML Injection Attacks

Source: SUNALERT
Type: UNKNOWN
248586

Source: CCN
Type: Sun Alert ID: 248586
Multiple Security Vulnerabilities in the Flash Player Plugin for Solaris

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3338

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm

Source: CCN
Type: ASA-2008-440
flash-plugin security update (RHSA-2008-0980)

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm

Source: CCN
Type: ASA-2009-020
Multiple Security Vulnerabilities in the Flash Player Plugin for Solaris (Sun 248586)

Source: CCN
Type: NORTEL BULLETIN ID: 2009009312, Rev 1
Nortel Response to Sun Alert 248586 - Multiple Security Vulnerabilities in the Flash Player Plugin for Solaris

Source: CONFIRM
Type: UNKNOWN
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=834256&poid=

Source: CCN
Type: Adobe Product Security Bulletin APSB08-20
Flash Player update available to address security vulnerabilities

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb08-20.html

Source: CCN
Type: GLSA-200903-23
Adobe Flash Player: Multiple vulnerabilities

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0980

Source: BID
Type: Patch
32129

Source: CCN
Type: BID-32129
Adobe Flash Player Multiple Security Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1021151

Source: CERT
Type: US Government Resource
TA08-350A

Source: VUPEN
Type: UNKNOWN
ADV-2008-3444

Source: XF
Type: UNKNOWN
adobe-flash-actionscript-xss(46536)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.16:*:windows:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.28.0:*:mac_os_x:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version <= 9.0.124.0)

    • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:adobe:flash_player_for_linux:9.0.115.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.28.0::mac_os_x:*:*:*:*:*
  • OR cpe:/a:adobe:flash_player:9.0.16::windows:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_extras:3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_89::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_89::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_95::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_95::x86:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_88::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_88::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_87::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_86::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_86::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_87::sparc:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_100::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_100::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_102::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_102::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_91::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_91::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_90::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_90::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_101::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_101::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_92::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_93::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_94::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_99::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_98::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_97::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_96::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_94::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_93::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_99::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_97::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_98::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_96::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_103::sparc:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_103::x86:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:22730
    P
    		ELSA-2008:0945: flash-plugin security update (Critical)
    2014-05-26
    oval:com.redhat.rhsa:def:20080945
    P
    		RHSA-2008:0945: flash-plugin security update (Critical)
    2008-11-18
    BACK
    adobe flash player 7.0.69.0
    adobe flash player 8.0.39.0
    adobe flash player 9.0
    adobe flash player 9.0.16
    adobe flash player 9.0.16
    adobe flash player 9.0.18d60
    adobe flash player 9.0.20
    adobe flash player 9.0.20.0
    adobe flash player 9.0.28
    adobe flash player 9.0.28.0
    adobe flash player 9.0.28.0
    adobe flash player 9.0.31
    adobe flash player 9.0.31.0
    adobe flash player 9.0.45.0
    adobe flash player 9.0.47.0
    adobe flash player 9.0.48.0
    adobe flash player 9.0.112.0
    adobe flash player 9.0.114.0
    adobe flash player 9.0.115.0
    adobe flash player *
    adobe flash playe for linux 9.0.115.0
    adobe flash player 9.0.28
    adobe flash player 9.0.31
    adobe flash player 9.0.45.0
    adobe flash player 9.0.47.0
    adobe flash player 9.0.48.0
    adobe flash player 7.0.69.0
    adobe flash player 9.0.115.0
    adobe flash player 9.0.16
    adobe flash player 9.0.18d60
    adobe flash player 9.0.20.0
    adobe flash player 9.0.28.0
    adobe flash player 9.0.31.0
    adobe flash player 9.0.114.0
    adobe flash player 9.0.20
    adobe flash player 9.0.124.0
    adobe flash player 8.0.39.0
    adobe flash player 9.0.112.0
    adobe flash player 9.0.28.0
    adobe flash player 9.0.16
    gentoo linux *
    sun solaris 10
    sun solaris 10
    redhat rhel extras 3
    redhat rhel extras 4
    apple mac os x 10.5
    apple mac os x server 10.5
    apple mac os x 10.4.11
    apple mac os x 10.5.1
    apple mac os x server 10.4.11
    apple mac os x server 10.5.1
    apple mac os x 10.5.2
    apple mac os x server 10.5.2
    apple mac os x server 10.5.3
    apple mac os x 10.5.3
    sun opensolaris build_snv_89
    sun opensolaris build_snv_89
    sun opensolaris build_snv_95
    sun opensolaris build_snv_95
    apple mac os x 10.5.4
    apple mac os x server 10.5.4
    sun opensolaris build_snv_88
    sun opensolaris build_snv_88
    sun opensolaris build_snv_87
    sun opensolaris build_snv_86
    sun opensolaris build_snv_86
    sun opensolaris build_snv_87
    apple mac os x 10.5.5
    apple mac os x server 10.5.5
    sun opensolaris build_snv_100
    sun opensolaris build_snv_100
    sun opensolaris build_snv_102
    sun opensolaris build_snv_102
    sun opensolaris build_snv_91
    sun opensolaris build_snv_91
    sun opensolaris build_snv_90
    sun opensolaris build_snv_90
    sun opensolaris build_snv_101
    sun opensolaris build_snv_101
    sun opensolaris build_snv_92
    sun opensolaris build_snv_93
    sun opensolaris build_snv_94
    sun opensolaris build_snv_99
    sun opensolaris build_snv_98
    sun opensolaris build_snv_97
    sun opensolaris build_snv_96
    sun opensolaris build_snv_94
    sun opensolaris build_snv_93
    sun opensolaris build_snv_99
    sun opensolaris build_snv_97
    sun opensolaris build_snv_98
    sun opensolaris build_snv_96
    sun opensolaris build_snv_103
    sun opensolaris build_snv_103