vulnwire
4.3med

CVE-2008-0582

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.1 through 3.6.0.244 on Windows allows remote attackers t…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.1 through 3.6.0.244 on Windows allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Full Name field of a reviewer of a business item entry, accessible through (1) the SkypeFind dialog and (2) a skype:?skypefind URI for the skype: URI handler.

Exploit prediction (EPSS)

1.21% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • aviv.raffon.net /2008/01/31/AttackersCanSkypeFindYou.aspx · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/27338 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /archive/1/487370/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • kb.cert.org /vuls/id/794236 · third-party-advisory, x_refsource_CERT-VN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.