CVE-2008-2640 - CVE House

Back to Database

Status published Medium CVE-2008-2640

Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History...

4.3 CVSS

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/. NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-2640

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from adobe

View All →

reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for...

reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop...

Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and...

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and...

Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and...

Affected Vendor

adobe

View all reports →

Affected Software

flex, flex builder

Vulnerable Versions:

3.0.1, 3

Timeline

Official Publish: June 18th, 2008

Last Modified: August 7th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.