Log in Start free

Actively exploited · Published Feb 16, 2012 · Assigned by adobe

CVE-2012-0767

Medium 6.1 Exploited

In plain English

A medium-severity cross-site scripting in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)6.2%top 6.5% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Jun 22, 2022.

Official description

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References