CVE-2012-0767KEV · OVERDUE

Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability

Medium · published February 16, 2012

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.1. It is confirmed in active exploitation. It sits in the 93.4th percentile for exploit probability.

1583
days past CISA
deadline
CVSS v3.1
6.1
EPSS
6%
Percentile
93.4
In the wild
Confirmed
What it is

⚠️ This Universal XSS vulnerability in Adobe Flash Player is like leaving your front door wide open—inviting unwanted guests right in! Think of it as a restaurant where diners can slip in their own secret ingredients into every dish, potentially ruining the meal for everyone at the table. An attacker can inject arbitrary scripts or HTML, leading to a feast of security woes! By exploiting this vulnerability, attackers could execute their malicious scripts in the context of the user's browser, leading to disastrous consequences like data theft, session hijacking, or even malware installation. This means a single click could turn your computer into a pirate ship ready to sail into the stormy seas of the internet!

Put simply

Think of it as a restaurant where diners can slip in their own secret ingredients into every dish, potentially ruining the meal for everyone at the table. An attacker can inject arbitrary scripts or HTML, leading to a feast of security woes! This cross-site scripting (XSS) vulnerability allows attackers to inject malicious web scripts into Adobe Flash Player through unspecified vectors, affecting multiple platforms including Windows, Mac OS X, Linux, and even Android devices.

What to do

By exploiting this vulnerability, attackers could execute their malicious scripts in the context of the user's browser, leading to disastrous consequences like data theft, session hijacking, or even malware installation. This means a single click could turn your computer into a pirate ship ready to sail into the stormy seas of the internet! To protect yourself, update Adobe Flash Player to versions 10.3.183.15 or higher, and 11.1.102.62 or higher for the other affected platforms. If you're still using Flash (yikes!), consider removing it altogether for better security! You've got this! By updating your software, you can slam that door shut on attackers and keep your digital space safe! 🛡️

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.06187 · 93.4th percentile
Published
2012-02-16T19:00Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 16 FEB 19:00Z
    Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before…
    cvelistv5