« Volver al listado

CVE-2008-1093

Estado: ModificadaAlta (9.3)—

Acresso InstallShield Update Agent does not properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers, which allows remote man-in-the-middle attackers to execute arbitrary VBScript code via Trojan horse Rules.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Acresso — Flexnet ConnectAcresso — Intallshield Update Agent

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-1093",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-09-18T15:04:27.093",
  "references": [
    {
      "url": "http://secunia.com/advisories/31896",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4268",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/837092",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/496389/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31204",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1020893",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.simplicity.net/vuln/CVE-2008-1093.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2613",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31896",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/4268",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/837092",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/496389/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31204",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1020893",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.simplicity.net/vuln/CVE-2008-1093.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2613",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Acresso InstallShield Update Agent does not properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers, which allows remote man-in-the-middle attackers to execute arbitrary VBScript code via Trojan horse Rules."
    },
    {
      "lang": "es",
      "value": "Acresso InstallShield Update Agent verifica adecuadamente la autenticidad de \"Rule Scripts\" (Regla de Secuencias de comandos) obtenida de las páginas GetRules.asp sobre servidores FLEXnet Connect, lo que permite a atacantes remotos de tipo 'hombre en el medio' (man-in-the-middle) ejecutar código VBScript de su elección a través de las reglas de un troyano."
    }
  ],
  "lastModified": "2026-06-16T22:50:58.553",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:acresso:flexnet_connect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB0E0E5C-DD84-4F11-B643-1FA49B21F6A4"
            },
            {
              "criteria": "cpe:2.3:a:acresso:intallshield_update_agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75218D2E-F247-4240-B94E-33965FE9979B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}