Secunia

A vulnerability has been reported in Adobe Flex 3, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input passed to historyFrame.html as used by Flex 3 History Management is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the web application developed with Flex 3 has History Management enabled.

The vulnerability affects Flex 3.0.1 SDK and Flex Builder 3.

Solution
Update to version 3.0.2 SDK and apply the updated historyFrame.html file on currently deployed Flex 3 web applications (see vendor's advisory for more information).
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Ory Segal, Adi Sharabani, and Ayal Yogev of IBM Rational Application Security.

Original Advisory
APSB08-14:
http://www.adobe.com/support/security/bulletins/apsb08-14.html

Deep Links
Links available in Customer Area