Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2002-1467: Flash Player can let attackers read any file

CVE-2002-1467 · published 23 years ago

Summary

Older versions of Macromedia Flash Player (before 6.0.47.0) let a web page trick the plugin into ignoring its normal security checks. This bypass allows a remote attacker to read files on a user's computer through specially crafted web content. Upgrade to a newer Flash version or stop using Flash altogether to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
macromedia	flash_player	6.0 6.0.29.0 6.0.40.0 `cpe:2.3:a:macromedia:flash_player:6.0:::::::*`
macromedia	shockwave	8.0 `cpe:2.3:a:macromedia:shockwave:8.0:::::::*`

Original advisory text

Macromedia Flash Plugin before 6,0,47,0 allows remote attackers to bypass the same-domain restriction and read arbitrary files via (1) an HTTP redirect, (2) a "file://" base in a web document, or (...

References

http://online.securityfocus.com/archive/1/286625 Exploit Patch Vendor Advisory
http://www.iss.net/security_center/static/9797.php Patch Vendor Advisory
http://www.macromedia.com/v1/handlers/index.cfm?ID=23294
http://www.securityfocus.com/bid/5429 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published22 Apr 2003

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2002-1467 · NVD

Track software like this

Free during beta