CVE-2008-1654: Cross-Site Request Forgery (CSRF)

CVSS: 4.3v2.0MediumModified

Published 02-04-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1654 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability. EPSS estimates a 4.80% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

4.80%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2008:0221

Timeline

02-04-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point, as demonstrated by changing the primary DNS server.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

4.80%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.80% on 20-09-2026

20-09-202620-10-2026

EPSS score

4.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Affected systems

No affected systems are recorded for this record.

References

22 links

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11435VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/29865Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30507Third Party AdvisoryX Refsource SECUNIA
www.adobe.com/support/security/bulletins/apsb08-11.htmlX Refsource CONFIRM
seclists.org/fulldisclosure/2008/Jan/0204.htmlMailing ListX Refsource FULLDISC
www.vupen.com/english/advisories/2008/1724/referencesVDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2008-0221.htmlVendor AdvisoryX Refsource REDHAT
www.us-cert.gov/cas/techalerts/TA08-150A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/30430Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/41718VDB EntryX Refsource XF

Show all 22 references

lists.apple.com/archives/security-announce/2008//May/msg00001.htmlVendor AdvisoryX Refsource APPLE
lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.htmlVendor AdvisoryX Refsource SUSE
www.securitytracker.com/id?1019807VDB EntryX Refsource SECTRACK
www.gnucitizen.org/blog/hacking-the-interwebs/X Refsource MISC
secunia.com/advisories/29763Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/28696VDB EntryX Refsource BID
sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1Vendor AdvisoryX Refsource SUNALERT
www.kb.cert.org/vuls/id/347812Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.gentoo.org/security/en/glsa/glsa-200804-21.xmlVendor AdvisoryX Refsource GENTOO
seclists.org/bugtraq/2008/Jan/0182.htmlMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2008/1697VDB EntryX Refsource VUPEN
www.us-cert.gov/cas/techalerts/TA08-100A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource