« Volver al listado

CVE-2008-0454

Estado: ModificadaAlta (9.3)—

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Internet ExplorerSkype Technologies — Skype

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-0454",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-01-25T01:00:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://skype.com/security/skype-sb-2008-001-update1.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://skype.com/security/skype-sb-2008-001.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.critical.lt/?opinions/show/1470",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gnucitizen.org/blog/vulnerabilities-in-skype",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/248184",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/486512/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/27338",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0194",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39754",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://skype.com/security/skype-sb-2008-001-update1.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://skype.com/security/skype-sb-2008-001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.critical.lt/?opinions/show/1470",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gnucitizen.org/blog/vulnerabilities-in-skype",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/248184",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/486512/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27338",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0194",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39754",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the \"Add video to chat\" dialog, aka \"videomood XSS.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en zonas cruzadas en el control web Internet Explorer de Skype 3.6.0.244, y versiones anteriores 3.5.x y 3.6.x en Windows, permite a atacantes remotos con la complicidad del usuario inyectar secuencias de comandos web o HTML de su elección en la Zona de Máquina Local mediante el campo Title de un (1) Dailymotion y posiblemente (2) una película Metacafe en la galería de vídeos de Skype, accesible a través de una búsqueda dentro del diálogo \"Add video to chat\", también conocido como \"videomood XSS\"."
    }
  ],
  "lastModified": "2026-06-16T22:49:40.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8682FAF3-98E3-485C-89CB-C0358C4E2AB0"
            },
            {
              "criteria": "cpe:2.3:a:skype_technologies:skype:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E42246D5-0D25-4630-84EF-A0B6CFE0AA72",
              "versionEndIncluding": "3.6.0.244"
            },
            {
              "criteria": "cpe:2.3:a:skype_technologies:skype:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D09CC031-8F8F-4BC4-AEFF-4FD98411B272"
            },
            {
              "criteria": "cpe:2.3:a:skype_technologies:skype:3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD01462B-281F-4299-8D85-3FC6E6D392A8"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}