CVE-2010-4396
Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web…
Does this matter?
Lower severity and a low EPSS score (1.16%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.16% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- realnetworks/realplayer · realnetworks/realplayer sp
- Source
- cve@mitre.org
References
- http://osvdb.org/69855
- http://service.real.com/realplayer/security/12102010_player/en/Vendor Advisory
- http://www.securitytracker.com/id?1024861
- http://www.zerodayinitiative.com/advisories/ZDI-10-275
- http://osvdb.org/69855
- http://service.real.com/realplayer/security/12102010_player/en/Vendor Advisory
- http://www.securitytracker.com/id?1024861
- http://www.zerodayinitiative.com/advisories/ZDI-10-275
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.