CVEvulnerability

CVE-2008-4401

10.0 HIGH Published 2008-10-17 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-10-17
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-264

Description

ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.

Affected configurations

• adobe flash player (<= 9.0.124.0) • adobe flash player 7.0 • adobe flash player 7.0.1 • adobe flash player 7.0.25 • adobe flash player 7.0.63 • adobe flash player 7.0.69.0 • adobe flash player 7.0.70.0 • adobe flash player 7.0 r67 • adobe flash player 7.1 • adobe flash player 7.1.1 • adobe flash player 7.2 • adobe flash player 8.0 • adobe flash player 8.0.24.0 • adobe flash player 8.0.34.0 • adobe flash player 8.0.35.0 • adobe flash player 8.0.39.0 • adobe flash player 9.0 • adobe flash player 9.0.112.0 • adobe flash player 9.0.114.0 • adobe flash player 9.0.115.0

Related

Weakness · not in database (1)

References