CVE-2011-2461: XSS
First published: Thu Dec 01 2011(Updated: )
Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Flex SDK | =3.1 | |
| Adobe Flex SDK | =3.4.1 | |
| Adobe Flex SDK | =3.5a | |
| Adobe Flex SDK | =3.6 | |
| Adobe Flex SDK | =4.1 | |
| Adobe Flex SDK | =3.2 | |
| Adobe Flex SDK | =3.3 | |
| Adobe Flex SDK | =4.5 | |
| Adobe Flex SDK | =3.5 | |
| Adobe Flex SDK | =3.0 | |
| Adobe Flex SDK | =3.4 | |
| Adobe Flex SDK | =3.0.1 | |
| Adobe Flex SDK | =4.5.1 | |
| Adobe Flex SDK | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.adobe.com/support/security/bulletins/apsb11-25.html
- http://kb2.adobe.com/cps/915/cpsid_91544.html
- http://secunia.com/advisories/47053
- http://packetstormsecurity.com/files/131376/Magento-eCommerce-Vulnerable-Adobe-Flex-SDK.html
- https://threatpost.com/adobe-cve-2011-2461-remains-exploitable-four-years-after-patch/111754
- http://blog.nibblesec.org/2015/03/the-old-is-new-again-cve-2011-2461-is.html
- http://blog.mindedsecurity.com/2015/03/the-old-is-new-again-cve-2011-2461-is.html
Frequently Asked Questions
What is the severity of CVE-2011-2461?
CVE-2011-2461 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2011-2461?
To fix CVE-2011-2461, update to Adobe Flex SDK version 4.6 or later where this vulnerability has been addressed.
What types of attacks can CVE-2011-2461 facilitate?
CVE-2011-2461 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into web pages.
Which versions of Adobe Flex SDK are affected by CVE-2011-2461?
CVE-2011-2461 affects Adobe Flex SDK versions 3.x and 4.x before 4.6.
Can CVE-2011-2461 affect my web application?
Yes, if your web application uses vulnerable versions of the Adobe Flex SDK, it can be exposed to XSS vulnerabilities.
- collector/nvd-historical
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/weakness
- agent/tags
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- vendor/adobe
- canonical/adobe flex sdk
- version/adobe flex sdk/3.1
- version/adobe flex sdk/3.4.1
- version/adobe flex sdk/3.5a
- version/adobe flex sdk/3.6
- version/adobe flex sdk/4.1
- version/adobe flex sdk/3.2
- version/adobe flex sdk/3.3
- version/adobe flex sdk/4.5
- version/adobe flex sdk/3.5
- version/adobe flex sdk/3.0
- version/adobe flex sdk/3.4
- version/adobe flex sdk/3.0.1
- version/adobe flex sdk/4.5.1
- version/adobe flex sdk/4.0