CVE-2012-0767
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2012-0767 is a cross-site scripting (XSS) vulnerability in Adobe Flash Player that allows remote attackers to inject web script or HTML into web pages viewed by other users. The flaw enables an attacker to craft Flash content that, when loaded in a victim's browser, executes arbitrary JavaScript in the context of the hosting domain. This can lead to session hijacking, credential theft, and phishing attacks. CISA has added CVE-2012-0767 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 16.3% (94th percentile), the vulnerability presents a notable risk, particularly on systems still running Flash Player.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player | < 10.3.183.15; >= 11.0, < 11.1.102.62; < 11.1.111.6; < 11.1.115.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html(Broken Link)
- http://rhn.redhat.com/errata/RHSA-2012-0144.html(Third Party Advisory)
- http://secunia.com/advisories/48265(Broken Link)
- http://secunia.com/advisories/48819(Broken Link)
- http://security.gentoo.org/glsa/glsa-201204-07.xml(Third Party Advisory)
- http://www.adobe.com/support/security/bulletins/apsb12-03.html(Broken Link, Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806(Third Party Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15933(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0767(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-0767 exploits a cross-site scripting weakness in Adobe Flash Player where the application fails to properly neutralize user-controllable input before it is incorporated into web page output. This allows an attacker to inject malicious scripts through crafted Flash content that execute in the context of the victim's browser session.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Impact Analysis
CVE-2012-0767 is remotely exploitable through malicious Flash content served via a web page. No authentication is required, and user interaction is limited to visiting the page containing the crafted Flash object. While XSS vulnerabilities do not directly enable arbitrary code execution on the operating system, they are highly impactful in the web context — a successful exploit can steal session cookies, capture user credentials through injected forms, redirect users to phishing sites, or perform actions on behalf of the victim within the affected web application. The EPSS score of 16.3% (94th percentile) indicates a significant likelihood of exploitation. Since Adobe Flash Player is end-of-life, any remaining installations are permanently vulnerable to this and all other Flash Player security issues.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2012-0767 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 8, 2022. The EPSS score of 16.3% places this vulnerability in the 94th percentile, indicating a notable probability of exploitation. Adobe Flash Player reached end-of-life on December 31, 2020, and the CISA required action states that the impacted product should be disconnected if still in use. While no ransomware association has been reported for this XSS vulnerability, the ability to inject scripts into web sessions makes it useful for credential harvesting and targeted phishing campaigns.
Remediation
- Remove Adobe Flash Player entirely: As Flash Player is end-of-life with no further security updates, uninstall it from all systems. The CISA required action explicitly directs disconnection of end-of-life products.
- Block Flash content at the network perimeter: Configure web proxies, firewalls, and content security policies to prevent SWF files and other Flash content from reaching endpoints.
- Implement Content Security Policy (CSP) headers: Deploy CSP headers on all web applications to restrict script execution sources, mitigating the impact of any residual XSS vectors.
- Audit web applications for Flash dependencies: Identify and replace any web applications or content management systems that still serve or embed Flash content with modern HTML5 alternatives.
- Monitor for Flash-based attack indicators: Configure security monitoring to detect SWF file downloads, Flash Player process execution, or suspicious JavaScript injection patterns that may indicate exploitation attempts.
Technical Details
CVE-2012-0767 is a reflected cross-site scripting vulnerability in Adobe Flash Player that occurs when the player fails to properly sanitize input parameters before incorporating them into generated web content. When a victim visits a page containing a specially crafted Flash object, the unsanitized input is reflected back into the page context, allowing attacker-controlled JavaScript to execute within the victim's browser session. This vulnerability is classified under CWE-79, as the root cause is improper neutralization of user input during web page generation. The Flash Player's integration with the browser DOM means that injected scripts have access to the same origin context, enabling cookie theft, DOM manipulation, and XMLHttpRequest abuse. The XSS attack can be delivered through malicious advertisements, embedded Flash content on compromised sites, or direct links to pages hosting the crafted Flash object.
Frequently Asked Questions
Is CVE-2012-0767 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2012-0767 to the Known Exploited Vulnerabilities catalog. The EPSS score of 16.3% in the 94th percentile indicates notable exploitation activity. Flash Player's end-of-life status means no patches will address this vulnerability.
What products are affected by CVE-2012-0767?
CVE-2012-0767 affects Adobe Flash Player, which reached end-of-life on December 31, 2020. All versions of Flash Player are considered vulnerable if the specific patch was not applied prior to end-of-life.
How do I fix CVE-2012-0767?
The only effective remediation is to completely remove Adobe Flash Player from all systems. Additionally, block Flash content at the network level and implement Content Security Policy headers on web applications to restrict unauthorized script execution.
How severe is CVE-2012-0767?
CVE-2012-0767 is a significant XSS vulnerability that enables session hijacking, credential theft, and phishing attacks through crafted Flash content. While XSS does not directly enable OS-level code execution, the web-based impact is severe, and the permanent end-of-life status of Flash Player means no fix will ever be released.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.