CVE-2008-4401

Status: ModifiedHigh (10)—
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
CVSS

Version: 2.0
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Base score: 10
Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 8.96%
Percentile among all scored CVEs: 95
Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)

Adobe — Flash Player
CWEs

CWE-264
References

Raw JSON (NVD)

Show
{
  "id": "CVE-2008-4401",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-10-17T19:31:15.073",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32270",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32448",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32702",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32759",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/33390",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/34226",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1021061",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2838",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32270",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32448",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32702",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32759",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33390",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/34226",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200903-23.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1021061",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2838",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file."
    },
    {
      "lang": "es",
      "value": "ActionScript en Adobe Flash Player 9.0.124.0 y anteriores no requiere interacción del usuario en conjunción con (1) la operación FileReference.browse en la API de subida FileReference upload o (2) la operación FileReference.download en la API de descarga FileReference, lo que permite a atacantes remotos crear un cuadro de diálogo de exploración y ,posiblemente tener otro impacto no especificado, mediante un fichero SWF."
    }
  ],
  "lastModified": "2026-06-16T22:57:44.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE43678F-7BFF-43EF-8968-B440E2BEF76F",
              "versionEndIncluding": "9.0.124.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDFF4A51-C936-4C5B-8276-FD454C9E4F40"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5ECC9D7-3386-4FEA-9218-91E31FF90F3A"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0E93289-6EE0-401A-958D-F59D2CDAE2F1"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FA3E556-BF8F-4D30-8DE5-09DA3FD8D5C3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A82D5B56-44E0-4120-B73E-0A1155AF4B05"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E895107-ED8A-4F88-87C3-935EAE299C01"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.0_r67:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AB20235-B2F2-426E-B797-BFA361CEC488"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4007D621-A0BC-4927-82A7-10D73802BCF8"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "641776AE-5408-439E-8290-DD9324771874"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "138A932A-D775-46A2-86EC-3C03C96884C4"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D12E3957-D7B2-4F3B-BB64-8B50B8958DEF"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32912721-F750-4C20-B999-E728F7D3A85D"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A95FA639-346C-491C-81A8-6C2A7B01AA19"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9F1E5AB-DEFA-42FC-A299-C8EEB778F9C6"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC7DD938-F963-4E03-B66B-F00436E4EA9D"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2A0777F-22C2-4FD5-BE81-8982BE6874D2"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AE89894-E492-4380-8A2B-4CDD3A15667A"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C6ED706-BAF2-4795-B597-6F7EE8CA8911"
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "260E2CF6-4D15-4168-A933-3EC52D8F93FF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}