header-logo
Suggest Exploit
vendor:
Flex SDK
by:
SecurityFocus
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: Flex SDK
Affected Version From: Flex SDK 3.4 and prior
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008

Adobe Flex SDK Cross-Site Scripting Vulnerability

Adobe Flex SDK is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to express-install template files. An attacker could exploit this vulnerability to execute arbitrary script code in the context of a web application built using the SDK. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to generate template files. Additionally, the application should be configured to use the latest version of the Flex SDK.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/36087/info

Adobe Flex SDK is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to express-install template files.

An attacker could exploit this vulnerability to execute arbitrary script code in the context of a web application built using the SDK. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Flex SDK 3.4 are vulnerable. 

http://www.example.com/Flex/index.template.html?"/></object><script>alert('XSS')</script>

Navigation

Suggest Exploit

Services By CQR