A potential cross-site scripting (XSS) issue has been identified within the Flex SDK express-install templates contained within the Flex 3.3 SDK and earlier versions. This Tech Note provides guidance on how to update older versions of the SDK and correct issues within existing web pages based on the older templates.
Patched express-installation-with-history/index.template.html file
Patched express-installation/index.template.html file
CAUTION: If you’ve customized your default index.template.html file (for example: added the allowFullScreen parameter, or added FlashVars or any other HTML changes), overwriting the existing index.template.html file with one of the attached files will undo all those changes. Follow steps 2a-2c in the previous example to manually update the HTML templates without losing your existing modifications.
NOTE: If you are not using Flex Builder or if you are using a custom HTML template which relies on express installation using AC_OETags.js, you will need to manually modify your HTML wrapper files and follow steps 2a-2c in the previous example.
NOTE: If you are using Flex Builder, the default installed Flex SDKs can be found at C:\Program Files\Adobe\Flex Builder 3\sdks\.
NOTE: The express installation index.template.html files will need to be overwritten for EACH Flex 3 SDK. For example, if you have Flex 3.0.0, Flex 3.1.0, Flex 3.2.0, and Flex 3.3.0 installed, you'll need to overwrite the index.template.html files in each of those installed SDKs.
If you compiled and deployed your Flex application using the express installation templates, you'll need to manually edit the HTML wrapper file(s) and change one line of code.
Twitter™ and Facebook posts are not covered under the terms of Creative Commons.
