CVE-2010-4396

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-12-14 · updated 2026-06-16
Weakness: CWE-20

Description

Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.

Affected products

RealNetworks Realplayer: 11.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5 (+2)
RealNetworks Realplayer Sp: 1.0.0, 1.0.1, 1.0.2, 1.0.5, 1.1, 1.1.1 (+4)

References

http://osvdb.org/69855
http://service.real.com/realplayer/security/12102010_player/en/
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-275
http://osvdb.org/69855
http://service.real.com/realplayer/security/12102010_player/en/
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-275

Get alerted when CVE-2010-4396 or the next vulnerability affects your stack