20016-2—Cross-Domain Misconfiguration - Adobe - Send

PUBLISHEDsecurity alertHigh

Active

Metadata

Alert ID:: 20016-2
Risk:: High
Type:: Active

Summary

Flash/Silverlight based cross-site request forgery may be possible, due to a misconfiguration on the web server.

Solution

Configure the crossdomain.xml file to restrict the list of domains that are allowed to make cross-domain send (but not necessarily read) requests to this web server, using . You should only grant access to "*" (all domains) if you are certain that this service is not vulnerable to Cross Site Request Forgery (CSRF) attacks.

Other info

The web server permits malicious cross-domain data send (but not necessarily read) requests originating from Flash/Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious send requests are processed using the privileges of the victim, and can result in Cross Site Request Forgery (CSRF) type attacks, via the victims web browser. This is particularly likely to be an issue if a Cookie based session implementation is in use.

References

browse all alerts