{"api_version":"1","generated_at":"2026-07-23T11:08:45+00:00","cve":"CVE-2008-2640","urls":{"html":"https://cve.report/CVE-2008-2640","api":"https://cve.report/api/cve/CVE-2008-2640.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2640","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2640"},"summary":{"title":"CVE-2008-2640","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/.  NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-06-18 19:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://securitytracker.com/id?1020301","name":"http://securitytracker.com/id?1020301","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Adobe Flex Input Validation Hole in History Manager Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/30746","name":"http://secunia.com/advisories/30746","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Adobe Flex 3 History Management Cross-Site Scripting Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29778","name":"http://www.securityfocus.com/bid/29778","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Adobe Flex 3 History Management 'historyFrame.html' Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43150","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43150","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/1862","name":"http://www.vupen.com/english/advisories/2008/1862","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.adobe.com/support/security/bulletins/apsb08-14.html","name":"http://www.adobe.com/support/security/bulletins/apsb08-14.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Adobe - Security Advisories : APSB08-14: Update to Flex 3 to address potential cross-site scripting vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://blog.watchfire.com/wfblog/2008/06/javascript-code.html","name":"http://blog.watchfire.com/wfblog/2008/06/javascript-code.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"IBM Rational Application Security Insider: JavaScript Code Flow Manipulation, and a real world example advisory - Adobe Flex 3 Dom-Based XSS","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2640","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2640","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2640","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"adobe","cpe5":"flex","cpe6":"3.0.1","cpe7":"*","cpe8":"sdk","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2640","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"adobe","cpe5":"flex_builder","cpe6":"3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:05:30.302Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.adobe.com/support/security/bulletins/apsb08-14.html"},{"name":"1020301","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1020301"},{"name":"adobeflex-historymanagement-xss(43150)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43150"},{"name":"30746","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30746"},{"name":"ADV-2008-1862","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1862"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://blog.watchfire.com/wfblog/2008/06/javascript-code.html"},{"name":"29778","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29778"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/.  NOTE: Firefox 2.0 and possibly other browsers prevent exploitation."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.adobe.com/support/security/bulletins/apsb08-14.html"},{"name":"1020301","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1020301"},{"name":"adobeflex-historymanagement-xss(43150)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43150"},{"name":"30746","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30746"},{"name":"ADV-2008-1862","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1862"},{"tags":["x_refsource_MISC"],"url":"http://blog.watchfire.com/wfblog/2008/06/javascript-code.html"},{"name":"29778","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29778"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2640","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/.  NOTE: Firefox 2.0 and possibly other browsers prevent exploitation."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.adobe.com/support/security/bulletins/apsb08-14.html","refsource":"CONFIRM","url":"http://www.adobe.com/support/security/bulletins/apsb08-14.html"},{"name":"1020301","refsource":"SECTRACK","url":"http://securitytracker.com/id?1020301"},{"name":"adobeflex-historymanagement-xss(43150)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43150"},{"name":"30746","refsource":"SECUNIA","url":"http://secunia.com/advisories/30746"},{"name":"ADV-2008-1862","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1862"},{"name":"http://blog.watchfire.com/wfblog/2008/06/javascript-code.html","refsource":"MISC","url":"http://blog.watchfire.com/wfblog/2008/06/javascript-code.html"},{"name":"29778","refsource":"BID","url":"http://www.securityfocus.com/bid/29778"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2640","datePublished":"2008-06-18T19:29:00.000Z","dateReserved":"2008-06-09T00:00:00.000Z","dateUpdated":"2024-08-07T09:05:30.302Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-18 19:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:adobe:flex:3.0.1:*:sdk:*:*:*:*:*","matchCriteriaId":"DDB08AFF-83FA-4D5D-8DDF-70AC8AC8275D"},{"vulnerable":true,"criteria":"cpe:2.3:a:adobe:flex_builder:3:*:*:*:*:*:*:*","matchCriteriaId":"8764CF7F-6DD8-4C3A-9251-70B86FD76B24"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2640","Ordinal":"1","Title":"CVE-2008-2640","CVE":"CVE-2008-2640","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2640","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/.  NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.","Type":"Description","Title":"CVE-2008-2640"},{"CveYear":"2008","CveId":"2640","Ordinal":"2","NoteData":"2008-06-18","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2640","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}