Vulnerability DatabaseCVE-2008-1654
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2008-1654
April 02, 2008
Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point, as demonstrated by changing the primary DNS server.
Related Resources (23)
http://www.securitytracker.com/id?1019807
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1
http://secunia.com/advisories/30430
https://exchange.xforce.ibmcloud.com/vulnerabilities/41718
http://www.vupen.com/english/advisories/2008/1697
http://www.securityfocus.com/bid/28696
http://secunia.com/advisories/29865
http://www.redhat.com/support/errata/RHSA-2008-0221.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html
http://www.gnucitizen.org/blog/hacking-the-interwebs/
https://people.canonical.com/~ubuntu-security/cve/CVE-2008-1654
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
http://www.kb.cert.org/vuls/id/347812
http://www.us-cert.gov/cas/techalerts/TA08-150A.html
http://www.us-cert.gov/cas/techalerts/TA08-100A.html
http://seclists.org/fulldisclosure/2008/Jan/0204.html
http://www.gentoo.org/security/en/glsa/glsa-200804-21.xml
http://secunia.com/advisories/30507
http://www.adobe.com/support/security/bulletins/apsb08-11.html
http://www.vupen.com/english/advisories/2008/1724/references
http://secunia.com/advisories/29763
http://seclists.org/bugtraq/2008/Jan/0182.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11435
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
CVSS v2
Base Score:
4.3
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
Weakness Type (CWE)
Cross-Site Request Forgery (CSRF)
CWE-352
EPSS
Base Score:
27.91