CVE-2007-3457

Adobe Flash Player < 8.0.34.0 - CSRF

Title source: rule

Description

Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file.

References (16)

[Patch, Vendor Advisory] http://secunia.com/advisories/26027

[Vendor Advisory] http://secunia.com/advisories/26118

[Vendor Advisory] http://secunia.com/advisories/26357

[Vendor Advisory] http://sunsolve.sun.com/search/document.do?assetkey=1-26-103167-1

[Vendor Advisory] http://sunsolve.sun.com/search/document.do?assetkey=1-66-201506-1

[Various Sources] http://www.adobe.com/support/security/bulletins/apsb07-12.html

[Third Party Advisory] http://www.gentoo.org/security/en/glsa/glsa-200708-01.xml

[US Government Resource] http://www.kb.cert.org/vuls/id/138457

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA07-192A.html

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/35338

[Vendor Advisory] http://www.novell.com/linux/security/advisories/2007_46_flashplayer.html

[Third Party Advisory, VDB Entry] http://www.osvdb.org/38049

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1018359

[Third Party Advisory] http://secunia.com/advisories/28068

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/2497

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/4190

Scores

EPSS 0.0513

EPSS Percentile 89.7%

Classification

CWE

CWE-352

Status draft

Affected Products (1)

adobe/flash_player < 8.0.34.0

Timeline

Published Jul 11, 2007

Tracked Since Feb 18, 2026