CVE-2008-4389
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not...
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.
- Record
CVE-2008-4389- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.
- Record
CVE-2008-4389- Updated
- 2026-11-02
EUVDEUVD-2008-4370 No score
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.
- Record
EUVD-2008-4370- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gmxw-wf52-2vxp No score
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not...
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.
- Record
GHSA-gmxw-wf52-2vxp- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-4389 is a high vulnerability (CVSS 9.3) in Symantec Appstream, published June 17, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. No source names a fixed version.
References
securityfocus.com/bid/40611
vupen.com/english/advisories/2010/1511
kb.cert.org/vuls/id/221257
secunia.com/advisories/40233
symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100616_00
exchange.xforce.ibmcloud.com/vulnerabilities/59504
nvd.nist.gov/vuln/detail/CVE-2008-4389
github.com/advisories/GHSA-gmxw-wf52-2vxp