CVE-2007-6244: adobe flash_player Cross-site Scripting
Vulnerability summary
CVE-2007-6244 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in adobe flash_player. EPSS estimates a 12.93% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 20-12-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
12.93%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 12.93% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundAdobe Flash Player 7.0.x/8.0.x/9.0.x - ActiveX Control 'navigateToURL' API Cross Domain Scripting
Maturity: weaponized
Adobe Flash Player 8.0.34.0/9.0.x - 'main.swf?baseurl' asfunction: Protocol Handler Cross-Site Scripting
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Adobe1 product
- flash_player8.0 | 9.0
1 vendor · 1 product
References
22 links- www.us-cert.gov/cas/techalerts/TA07-355A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- crypto.stanford.edu/advisories/CVE-2007-6244/X Refsource MISC
Show all 22 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10210VDB EntrySignatureX Refsource OVAL
- www.adobe.com/support/security/bulletins/apsb07-20.htmlX Refsource CONFIRM