{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-10-15T00:00:00", "descriptions": [{"lang": "en", "value": "ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-07T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "33390", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/33390"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"}, {"name": "32270", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32270"}, {"name": "32702", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32702"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"}, {"name": "34226", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34226"}, {"name": "ADV-2008-2838", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/2838"}, {"name": "1021061", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1021061"}, {"name": "GLSA-200903-23", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"}, {"name": "32759", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32759"}, {"name": "RHSA-2008:0945", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"}, {"name": "RHSA-2008:0980", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"}, {"name": "248586", "tags": ["vendor-advisory", "x_refsource_SUNALERT"], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"}, {"name": "32448", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32448"}, {"name": "adobe-flash-filereference-file-upload(45913)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"}, {"name": "SUSE-SR:2008:025", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-4401", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "33390", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/33390"}, {"name": "http://www.adobe.com/support/security/bulletins/apsb08-18.html", "refsource": "CONFIRM", "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"}, {"name": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm", "refsource": "CONFIRM", "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"}, {"name": "32270", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32270"}, {"name": "32702", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32702"}, {"name": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html", "refsource": "CONFIRM", "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"}, {"name": "34226", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34226"}, {"name": "ADV-2008-2838", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/2838"}, {"name": "1021061", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1021061"}, {"name": "GLSA-200903-23", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"}, {"name": "32759", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32759"}, {"name": "RHSA-2008:0945", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"}, {"name": "RHSA-2008:0980", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"}, {"name": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm", "refsource": "CONFIRM", "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"}, {"name": "248586", "refsource": "SUNALERT", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"}, {"name": "32448", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32448"}, {"name": "adobe-flash-filereference-file-upload(45913)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"}, {"name": "SUSE-SR:2008:025", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:17:09.693Z"}, "title": "CVE Program Container", "references": [{"name": "33390", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/33390"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"}, {"name": "32270", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32270"}, {"name": "32702", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32702"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"}, {"name": "34226", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/34226"}, {"name": "ADV-2008-2838", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/2838"}, {"name": "1021061", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1021061"}, {"name": "GLSA-200903-23", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"}, {"name": "32759", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32759"}, {"name": "RHSA-2008:0945", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"}, {"name": "RHSA-2008:0980", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"}, {"name": "248586", "tags": ["vendor-advisory", "x_refsource_SUNALERT", "x_transferred"], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"}, {"name": "32448", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32448"}, {"name": "adobe-flash-filereference-file-upload(45913)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"}, {"name": "SUSE-SR:2008:025", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-4401", "datePublished": "2008-10-17T18:00:00", "dateReserved": "2008-10-02T00:00:00", "dateUpdated": "2024-08-07T10:17:09.693Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE43678F-7BFF-43EF-8968-B440E2BEF76F", "versionEndIncluding": "9.0.124.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "DDFF4A51-C936-4C5B-8276-FD454C9E4F40", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "D5ECC9D7-3386-4FEA-9218-91E31FF90F3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*", "matchCriteriaId": "F0E93289-6EE0-401A-958D-F59D2CDAE2F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*", "matchCriteriaId": "0FA3E556-BF8F-4D30-8DE5-09DA3FD8D5C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*", "matchCriteriaId": "A82D5B56-44E0-4120-B73E-0A1155AF4B05", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*", "matchCriteriaId": "8E895107-ED8A-4F88-87C3-935EAE299C01", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.0_r67:*:*:*:*:*:*:*", "matchCriteriaId": "7AB20235-B2F2-426E-B797-BFA361CEC488", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*", "matchCriteriaId": "4007D621-A0BC-4927-82A7-10D73802BCF8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "641776AE-5408-439E-8290-DD9324771874", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*", "matchCriteriaId": "138A932A-D775-46A2-86EC-3C03C96884C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "D12E3957-D7B2-4F3B-BB64-8B50B8958DEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*", "matchCriteriaId": "32912721-F750-4C20-B999-E728F7D3A85D", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*", "matchCriteriaId": "A95FA639-346C-491C-81A8-6C2A7B01AA19", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*", "matchCriteriaId": "C9F1E5AB-DEFA-42FC-A299-C8EEB778F9C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*", "matchCriteriaId": "FC7DD938-F963-4E03-B66B-F00436E4EA9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "B2A0777F-22C2-4FD5-BE81-8982BE6874D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*", "matchCriteriaId": "7AE89894-E492-4380-8A2B-4CDD3A15667A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*", "matchCriteriaId": "1C6ED706-BAF2-4795-B597-6F7EE8CA8911", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*", "matchCriteriaId": "260E2CF6-4D15-4168-A933-3EC52D8F93FF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file."}, {"lang": "es", "value": "ActionScript en Adobe Flash Player 9.0.124.0 y anteriores no requiere interacci\u00f3n del usuario en conjunci\u00f3n con (1) la operaci\u00f3n FileReference.browse en la API de subida FileReference upload o (2) la operaci\u00f3n FileReference.download en la API de descarga FileReference, lo que permite a atacantes remotos crear un cuadro de di\u00e1logo de exploraci\u00f3n y ,posiblemente tener otro impacto no especificado, mediante un fichero SWF."}], "id": "CVE-2008-4401", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-10-17T19:31:15.073", "references": [{"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/32270"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/32448"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/32702"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/32759"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/33390"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/34226"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1021061"}, {"source": "cve@mitre.org", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"}, {"source": "cve@mitre.org", "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"}, {"source": "cve@mitre.org", "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"}, {"source": "cve@mitre.org", "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"}, {"source": "cve@mitre.org", "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"}, {"source": "cve@mitre.org", "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/2838"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/32270"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/32448"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/32702"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/32759"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/33390"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/34226"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1021061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/2838"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2008:0980", "cpe": "cpe:/a:redhat:rhel_extras:3", "package": "flash-plugin-0:9.0.151.0-1.el3.with.oss", "product_name": "Extras for RHEL 3", "release_date": "2008-11-12T00:00:00Z"}, {"advisory": "RHSA-2008:0980", "cpe": "cpe:/a:redhat:rhel_extras:4", "package": "flash-plugin-0:9.0.151.0-1.el4", "product_name": "Extras for RHEL 4", "release_date": "2008-11-12T00:00:00Z"}, {"advisory": "RHSA-2008:0945", "cpe": "cpe:/a:redhat:rhel_extras:5", "package": "flash-plugin-0:10.0.12.36-2.el5", "product_name": "Supplementary for Red Hat Enterprise Linux 5", "release_date": "2008-10-28T00:00:00Z"}], "bugzilla": {"description": "flash-plugin: upload/download user interaction", "id": "466154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=466154"}, "csaw": false, "details": ["ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file."], "name": "CVE-2008-4401", "public_date": "2008-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2008-4401\nhttps://nvd.nist.gov/vuln/detail/CVE-2008-4401"], "threat_severity": "Moderate"}

{}