CVE-2004-1798

CVE-2004-1798 describes a vulnerability in RealOne Player (including RealOne Enterprise Desktop and RealPlayer) versions 6.0.11.868 and earlier. It allows remote attackers to execute arbitrary JavaScript within the "My Computer" security zone by crafting a malicious Synchronized Multimedia Integration Language (SMIL) presentation that uses a "file:javascript:" URL. This JavaScript then executes in the security context of a previously loaded URL, enabling potential compromise. The vulnerability has a CVSS score of 5.1, indicating a medium severity. Its attack vector is network-based, but requires high attack complexity (AV:N/AC:H). Successful exploitation could lead to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness and a lack of widespread attention.