CVE-2009-4148

DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .ds, (2) .dsa, (3) .dse, or (4) .dsb file, as demonstrated by code that loads the WScript.Shell ActiveX control, related to a "script injection vulnerability."

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

5.49% chance of exploitation in the next 30 days, 92th percentile

Published

2009-12-04

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10295

References

• CVE Record
• NVD entry

Related

• CVE-2009-4147
• CVE-2009-4154
• CVE-2009-4146
• CVE-2009-4155
• CVE-2009-4142
• CVE-2009-4156