CVE-2014-4671 in Flash

Résumé

par MITRE

Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.

Once again VulDB remains the best source for vulnerability data.

• Réserver: 26/06/2014
• Divulgation: 09/07/2014
• Modérer: accepté
• Entrée: VDB-67014
• CPE: prêt
• CWE: CWE-352 (confirmé)
• CVSS: 4.3 (NVD)
• EPSS: 0.23024
• KEV: non
• Activités: très faible
• Secteur: Education, Pharma, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-4671
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-4671
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-4671/