CVE-2008-0582

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-02-05 · updated 2026-06-16
Weakness: CWE-94

Description

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.1 through 3.6.0.244 on Windows allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Full Name field of a reviewer of a business item entry, accessible through (1) the SkypeFind dialog and (2) a skype:?skypefind URI for the skype: URI handler.

Affected products

Skype Technologies Skype: 3.1, 3.2, 3.5, 3.6, 3.6.0.244

References

http://aviv.raffon.net/2008/01/31/AttackersCanSkypeFindYou.aspx
http://www.kb.cert.org/vuls/id/794236
http://www.securityfocus.com/archive/1/487370/100/0/threaded
http://www.securityfocus.com/bid/27338
http://aviv.raffon.net/2008/01/31/AttackersCanSkypeFindYou.aspx
http://www.kb.cert.org/vuls/id/794236
http://www.securityfocus.com/archive/1/487370/100/0/threaded
http://www.securityfocus.com/bid/27338

Get alerted when CVE-2008-0582 or the next vulnerability affects your stack