NVD

Id
32620  
Name
CVE-2014-4671  
Description
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-07-09  
Modified Date
2015-09-22  
Seq
2014-4671  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
171821 32620 CVE-2014-4671 http://helpx.adobe.com/security/products/flash-player/apsb14-17.html  View
171822 32620 CVE-2014-4671 http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/  View
171823 32620 CVE-2014-4671 RHSA-2014:0860  View
171824 32620 CVE-2014-4671 GLSA-201407-02  View
171825 32620 CVE-2014-4671 68457  View
171826 32620 CVE-2014-4671 1030533  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14381 JVNDB-2014-003256 Adobe Flash Player および Adobe AIR におけるクロスサイトリクエストフォージェリ攻撃を実行される脆弱性 Adobe Flash Player および Adobe AIR は、SWF ファイルフォーマットを適切に制限しないため、JSONP エンドポイントに対してクロスサイトリクエストフォージェリ攻撃を実行され、重要な情報を取得される脆弱性が存在します。 CVE-2014-4671 71960 CVE-2014-4671 32620 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003256.html 2014-07-08 2014-08-06 View