CVE-2008-6062: XSS

Published Feb 5, 2009

Updated

Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Insert Flash Video feature is used, allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName parameter. NOTE: this may overlap CVE-2007-6242, CVE-2007-6244, or CVE-2007-6637.

Affected Software

1 affected component

Adobe Dreamweaver

Remediation

Patch Available

http://www.adobe.com/support/security/bulletins/apsb07-20.html

Event History

Feb 5, 2009

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:30 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-6062?

CVE-2008-6062 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2008-6062?

To mitigate CVE-2008-6062, users should update Adobe Dreamweaver to the latest version that includes security patches addressing this vulnerability.

Which versions of Adobe Dreamweaver are affected by CVE-2008-6062?

CVE-2008-6062 affects various versions of Adobe Dreamweaver that utilize the Insert Flash Video feature.

What types of attacks can be executed by exploiting CVE-2008-6062?

Exploiting CVE-2008-6062 allows remote attackers to execute arbitrary web scripts or HTML via cross-site scripting, potentially leading to data theft or session hijacking.

Is there a specific workaround for CVE-2008-6062 if I can't update my software?

As a temporary workaround for CVE-2008-6062, consider disabling the Insert Flash Video feature in Adobe Dreamweaver if you cannot apply the update.