CVE-2008-1805

2008-06-0622:32:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2008-1805

skype

vulnerability

blacklist

uri

remote code execution

7.6 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.059 Low

EPSS

Percentile

93.4%

JSON

Incomplete blacklist vulnerability in Skype 3.6.0.248, and other versions before 3.8.0.139, allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI that ends in an executable extension that is not covered by the blacklist.

CPENameOperatorVersion
skype_technologies:skypeskype technologies skypeeq3.2.0.148
skype_technologies:skypeskype technologies skypeeq3.5.0.229
skype_technologies:skypeskype technologies skypeeq3.0.0.198
skype_technologies:skypeskype technologies skypeeq3.6.0.244
skype_technologies:skypeskype technologies skypeeq3.5.0.234
skype_technologies:skypeskype technologies skypeeq3.0.0.214
skype_technologies:skypeskype technologies skypeeq3.2.0.145
skype_technologies:skypeskype technologies skypeeq3.1.0.144
skype_technologies:skypeskype technologies skypeeq3.2.0.82
skype_technologies:skypeskype technologies skypeeq3.5.0.178

CPE	Name	Operator	Version
skype_technologies:skype	skype technologies skype	eq	3.2.0.148
skype_technologies:skype	skype technologies skype	eq	3.5.0.229
skype_technologies:skype	skype technologies skype	eq	3.0.0.198
skype_technologies:skype	skype technologies skype	eq	3.6.0.244
skype_technologies:skype	skype technologies skype	eq	3.5.0.234
skype_technologies:skype	skype technologies skype	eq	3.0.0.214
skype_technologies:skype	skype technologies skype	eq	3.2.0.145
skype_technologies:skype	skype technologies skype	eq	3.1.0.144
skype_technologies:skype	skype technologies skype	eq	3.2.0.82
skype_technologies:skype	skype technologies skype	eq	3.5.0.178