CVE-2010-4396
Estado: ModificadaMedia (4.3)—
Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.16%
- Percentil entre todas las CVEs puntuadas: 66
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-20
Referencias
- http://osvdb.org/69855
- http://service.real.com/realplayer/security/12102010_player/en/
- http://www.securitytracker.com/id?1024861
- http://www.zerodayinitiative.com/advisories/ZDI-10-275
- http://osvdb.org/69855
- http://service.real.com/realplayer/security/12102010_player/en/
- http://www.securitytracker.com/id?1024861
- http://www.zerodayinitiative.com/advisories/ZDI-10-275
JSON original (NVD)
Mostrar
{
"id": "CVE-2010-4396",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2010-12-14T16:00:05.133",
"references": [
{
"url": "http://osvdb.org/69855",
"source": "cve@mitre.org"
},
{
"url": "http://service.real.com/realplayer/security/12102010_player/en/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1024861",
"source": "cve@mitre.org"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-275",
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/69855",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://service.real.com/realplayer/security/12102010_player/en/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1024861",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-275",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en zonas cruzadas en el método HandleAction en control ActiveX en RealNetworks RealPlayer v11.0 hasta v11.1, RealPlayer SP v1.0 hasta v1.1.5, y RealPlayer Enterprise v2.1.2, permite a atacantes remotos inyectar código web o HTML de su elección en \"Local Zone\" especificando un archivo local en una acción NavigateToURL, como se demostró con un archivo local de \"skin\""
}
],
"lastModified": "2026-06-16T23:24:42.483",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8985B3B-BCC9-431D-9788-0C1949DF46E3"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C7517C2-71A8-4223-9F9A-2FE5A2153B53"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11B7CB5F-ACFA-439B-A9B7-54DA402A6029"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2A681B8-62F1-4B23-9E0B-39C61BE72F44"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F826B276-91E6-495E-B429-51B1C5ECB146"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A732E6C-108F-447F-98B1-EA774A0537EB"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D03738C3-D659-488D-B285-64A496C0F1FB"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BFD9C4F-E93B-4BCE-A5E2-A20945EB8534"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BBEBAA2-4892-4F9E-8C0E-94CA90DCD28D"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53D7AE43-A3AC-4B38-B0A3-E6F02834224F"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59FEDCDF-9FBF-4D08-A50F-FF92763DFC21"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54A11B3A-547C-4F2F-A58E-DE06DBBE8115"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7243D80-913D-405C-9988-B8473DB1A5DC"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4C6D399-FF31-441D-A363-BD53CFE5569A"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9818A6FB-2CF5-4236-8EFE-95458D603CC1"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73CC0582-D889-4907-A32E-218AC2B0591F"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B5DD6CF-CCC7-40DD-A6CA-B9BBC339998F"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E2BC096-43B6-4696-8467-CC3D0163EFF5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}