CVE-2014-8437 is a vulnerability in Adobe Flash Player, Adobe AIR, Adobe AIR SDK, and Adobe AIR SDK & Compiler across Windows, OS X, and Linux platforms, allowing remote attackers to discover session tokens through unspecified vectors. With a CVSS score of 5.0, it is considered a medium-severity issue, requiring no authentication and having low attack complexity, potentially leading to information disclosure. While not actively exploited in the wild and lacking public exploit code, it has received some community and media attention, indicating awareness of its potential impact. Organizations should patch affected Adobe products to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 13.0, < 13.0.0.252CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
>= 14.0, <= 14.0.0.179CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
>= 15.0, < 15.0.0.223CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
>= 11.0, < 11.2.202.418CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
<= 15.0.0.356CPE matchmatch criteria | cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.