Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2024-AVI-0678
Vulnerability from certfr_avis - Published: 2024-08-14 - Updated: 2024-08-14
De multiples vulnérabilités ont été découvertes dans les produits Adobe. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Adobe | Acrobat | Acrobat 2020 versions antérieures à 20.005.30655 | ||
| Adobe | Magento | Magento Open Source versions 2.4.5.x antérieures à 2.4.5-p9 | ||
| Adobe | Acrobat | Acrobat DC versions antérieures à 24.002.21005 | ||
| Adobe | Commerce | Commerce versions antérieures à 2.4.4-p10 | ||
| Adobe | Commerce | Commerce versions 2.4.7.x antérieures à 2.4.7-p2 | ||
| Adobe | Commerce | Commerce versions 2.4.6.x antérieures à 2.4.6-p7 | ||
| Adobe | Commerce | Commerce versions 2.4.5.x antérieures à 2.4.5-p9 | ||
| Adobe | Magento | Magento Open Source versions 2.4.6.x antérieures à 2.4.6-p7 | ||
| Adobe | Acrobat | Acrobat 2024 versions antérieures à 24.001.30159 | ||
| Adobe | Magento | Magento Open Source versions 2.4.7.x antérieures à 2.4.7-p2 | ||
| Adobe | Magento | Magento Open Source versions antérieures à 2.4.4-p10 | ||
| Adobe | Acrobat Reader | Acrobat Reader DC versions antérieures à 24.002.21005 | ||
| Adobe | Acrobat Reader | Acrobat Reader 2020 versions antérieures à 20.005.30655 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Acrobat 2020 versions ant\u00e9rieures \u00e0 20.005.30655",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.5.x ant\u00e9rieures \u00e0 2.4.5-p9",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Acrobat DC versions ant\u00e9rieures \u00e0 24.002.21005",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions ant\u00e9rieures \u00e0 2.4.4-p10",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.7.x ant\u00e9rieures \u00e0 2.4.7-p2",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.6.x ant\u00e9rieures \u00e0 2.4.6-p7",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Commerce versions 2.4.5.x ant\u00e9rieures \u00e0 2.4.5-p9",
"product": {
"name": "Commerce",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.6.x ant\u00e9rieures \u00e0 2.4.6-p7",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Acrobat 2024 versions ant\u00e9rieures \u00e0 24.001.30159",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions 2.4.7.x ant\u00e9rieures \u00e0 2.4.7-p2",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Magento Open Source versions ant\u00e9rieures \u00e0 2.4.4-p10",
"product": {
"name": "Magento",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Acrobat Reader DC versions ant\u00e9rieures \u00e0 24.002.21005",
"product": {
"name": "Acrobat Reader",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Acrobat Reader 2020 versions ant\u00e9rieures \u00e0 20.005.30655",
"product": {
"name": "Acrobat Reader",
"vendor": {
"name": "Adobe",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-41831",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41831"
},
{
"name": "CVE-2024-41832",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41832"
},
{
"name": "CVE-2024-39411",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39411"
},
{
"name": "CVE-2024-39413",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39413"
},
{
"name": "CVE-2024-39398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39398"
},
{
"name": "CVE-2024-39412",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39412"
},
{
"name": "CVE-2024-39425",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39425"
},
{
"name": "CVE-2024-39424",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39424"
},
{
"name": "CVE-2024-39418",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39418"
},
{
"name": "CVE-2024-39403",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39403"
},
{
"name": "CVE-2024-39408",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39408"
},
{
"name": "CVE-2024-41835",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41835"
},
{
"name": "CVE-2024-39401",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39401"
},
{
"name": "CVE-2024-39415",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39415"
},
{
"name": "CVE-2024-39426",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39426"
},
{
"name": "CVE-2024-39416",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39416"
},
{
"name": "CVE-2024-39402",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39402"
},
{
"name": "CVE-2024-39383",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39383"
},
{
"name": "CVE-2024-41833",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41833"
},
{
"name": "CVE-2024-39404",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39404"
},
{
"name": "CVE-2024-39406",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39406"
},
{
"name": "CVE-2024-39423",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39423"
},
{
"name": "CVE-2024-39419",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39419"
},
{
"name": "CVE-2024-41830",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41830"
},
{
"name": "CVE-2024-39400",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39400"
},
{
"name": "CVE-2024-39410",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39410"
},
{
"name": "CVE-2024-39422",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39422"
},
{
"name": "CVE-2024-39414",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39414"
},
{
"name": "CVE-2024-39417",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39417"
},
{
"name": "CVE-2024-39405",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39405"
},
{
"name": "CVE-2024-39409",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39409"
},
{
"name": "CVE-2024-41834",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41834"
},
{
"name": "CVE-2024-39407",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39407"
},
{
"name": "CVE-2024-39397",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39397"
},
{
"name": "CVE-2024-39399",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39399"
}
],
"initial_release_date": "2024-08-14T00:00:00",
"last_revision_date": "2024-08-14T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0678",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-08-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Adobe. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Adobe",
"vendor_advisories": [
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 Adobe apsb24-61",
"url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html"
},
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 Adobe apsb24-57",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
]
}
CVE-2024-39416 (GCVE-0-2024-39416)
Vulnerability from cvelistv5 – Published: 2024-08-14 11:57 – Updated: 2024-08-14 14:14
VLAI
EPSS
Title
Unauthorized user can export Orders Sale Report
Summary
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-285 - Improper Authorization (CWE-285)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/magento… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Adobe Commerce |
Affected:
0 , ≤ 2.4.4-p9
(semver)
|
|
| adobe | commerce |
Affected:
0 , ≤ 2.4.7-p1
(custom)
Affected: 0 , ≤ 2.4.6-p6 (custom) Affected: 0 , ≤ 2.4.5-p8 (custom) Affected: 0 , ≤ 2.4.4-p9 (custom) cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7-p1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T14:11:27.908876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T14:14:32.679Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "LOW",
"modifiedIntegrityImpact": "NONE",
"modifiedPrivilegesRequired": "LOW",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization (CWE-285)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T11:57:11.759Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthorized user can export Orders Sale Report"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39416",
"datePublished": "2024-08-14T11:57:11.759Z",
"dateReserved": "2024-06-24T20:32:06.594Z",
"dateUpdated": "2024-08-14T14:14:32.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39417 (GCVE-0-2024-39417)
Vulnerability from cvelistv5 – Published: 2024-08-14 11:57 – Updated: 2024-08-14 14:13
VLAI
EPSS
Title
An unauthorized user can export the Shipping Report
Summary
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-285 - Improper Authorization (CWE-285)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/magento… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Adobe Commerce |
Affected:
0 , ≤ 2.4.4-p9
(semver)
|
|
| adobe | commerce |
Affected:
0 , ≤ 2.4.7-p1
(custom)
Affected: 0 , ≤ 2.4.6-p6 (custom) Affected: 0 , ≤ 2.4.5-p8 (custom) Affected: 0 , ≤ 2.4.4-p9 (custom) cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7-p1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T14:09:31.164493Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T14:13:22.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "LOW",
"modifiedIntegrityImpact": "NONE",
"modifiedPrivilegesRequired": "LOW",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization (CWE-285)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T11:57:17.890Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "An unauthorized user can export the Shipping Report"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39417",
"datePublished": "2024-08-14T11:57:17.890Z",
"dateReserved": "2024-06-24T20:32:06.594Z",
"dateUpdated": "2024-08-14T14:13:22.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39418 (GCVE-0-2024-39418)
Vulnerability from cvelistv5 – Published: 2024-08-14 11:57 – Updated: 2024-09-17 11:07
VLAI
EPSS
Title
Adobe Commerce | Improper Authorization (CWE-285)
Summary
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-285 - Improper Authorization (CWE-285)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/magento… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Adobe Commerce |
Affected:
0 , ≤ 2.4.4-p9
(semver)
|
|
| adobe | commerce |
Affected:
0 , ≤ 2.4.7-p1
(custom)
Affected: 0 , ≤ 2.4.6-p6 (custom) Affected: 0 , ≤ 2.4.5-p8 (custom) Affected: 0 , ≤ 2.4.4-p9 (custom) cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7-p1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T14:08:28.760498Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T14:12:53.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 5.4,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "LOW",
"modifiedIntegrityImpact": "LOW",
"modifiedPrivilegesRequired": "LOW",
"modifiedScope": "UNCHANGED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 5.4,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization (CWE-285)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T11:07:31.253Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Adobe Commerce | Improper Authorization (CWE-285)"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39418",
"datePublished": "2024-08-14T11:57:20.916Z",
"dateReserved": "2024-06-24T20:32:06.594Z",
"dateUpdated": "2024-09-17T11:07:31.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39419 (GCVE-0-2024-39419)
Vulnerability from cvelistv5 – Published: 2024-08-14 11:57 – Updated: 2024-08-14 14:12
VLAI
EPSS
Title
A user without ship permissions can ship the orders
Summary
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-285 - Improper Authorization (CWE-285)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/magento… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Adobe Commerce |
Affected:
0 , ≤ 2.4.4-p9
(semver)
|
|
| adobe | commerce |
Affected:
0 , ≤ 2.4.7-p1
(custom)
Affected: 0 , ≤ 2.4.6-p6 (custom) Affected: 0 , ≤ 2.4.5-p8 (custom) Affected: 0 , ≤ 2.4.4-p9 (custom) cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7-p1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39419",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T14:08:00.420281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T14:12:33.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "NONE",
"modifiedIntegrityImpact": "LOW",
"modifiedPrivilegesRequired": "LOW",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization (CWE-285)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T11:57:22.405Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "A user without ship permissions can ship the orders"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39419",
"datePublished": "2024-08-14T11:57:22.405Z",
"dateReserved": "2024-06-24T20:32:06.595Z",
"dateUpdated": "2024-08-14T14:12:33.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39422 (GCVE-0-2024-39422)
Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55
VLAI
EPSS
Title
ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC
Summary
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-416 - Use After Free (CWE-416)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Acrobat Reader |
Affected:
0 , ≤ 24.001.30123
(semver)
|
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(custom)
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30636
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30635
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39422",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T03:55:53.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Acrobat Reader",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free (CWE-416)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T15:07:31.068Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39422",
"datePublished": "2024-08-14T15:07:31.068Z",
"dateReserved": "2024-06-24T20:32:06.595Z",
"dateUpdated": "2024-08-15T03:55:53.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39423 (GCVE-0-2024-39423)
Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55
VLAI
EPSS
Title
ZDI-CAN-24182: New Vulnerability Report - Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability
Summary
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write (CWE-787)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Acrobat Reader |
Affected:
0 , ≤ 24.001.30123
(semver)
|
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(custom)
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30636
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30635
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T03:55:54.569Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Acrobat Reader",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write (CWE-787)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T15:07:29.540Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ZDI-CAN-24182: New Vulnerability Report - Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39423",
"datePublished": "2024-08-14T15:07:29.540Z",
"dateReserved": "2024-06-24T20:32:06.595Z",
"dateUpdated": "2024-08-15T03:55:54.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39424 (GCVE-0-2024-39424)
Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55
VLAI
EPSS
Title
ZDI-CAN-24309: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Summary
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-416 - Use After Free (CWE-416)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Acrobat Reader |
Affected:
0 , ≤ 24.001.30123
(semver)
|
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(custom)
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30636
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30635
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T03:55:55.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Acrobat Reader",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free (CWE-416)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T15:07:26.473Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ZDI-CAN-24309: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39424",
"datePublished": "2024-08-14T15:07:26.473Z",
"dateReserved": "2024-06-24T20:32:06.595Z",
"dateUpdated": "2024-08-15T03:55:55.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39425 (GCVE-0-2024-39425)
Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55
VLAI
EPSS
Title
Security vulnerability in AdobeARMHelper
Summary
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Acrobat Reader |
Affected:
0 , ≤ 24.001.30123
(semver)
|
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(custom)
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30636
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30635
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T03:55:56.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Acrobat Reader",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "HIGH",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "LOW",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T15:07:23.644Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Security vulnerability in AdobeARMHelper"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39425",
"datePublished": "2024-08-14T15:07:23.644Z",
"dateReserved": "2024-06-24T20:32:06.595Z",
"dateUpdated": "2024-08-15T03:55:56.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39426 (GCVE-0-2024-39426)
Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55
VLAI
EPSS
Title
ZDI-CAN-24312: Adobe Acrobat Reader DC Annotation Memory Corruption Remote Code Execution Vulnerability
Summary
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read (CWE-125)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Acrobat Reader |
Affected:
0 , ≤ 24.001.30123
(semver)
|
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(custom)
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30636
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30635
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T03:55:58.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Acrobat Reader",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read (CWE-125)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T15:07:32.157Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ZDI-CAN-24312: Adobe Acrobat Reader DC Annotation Memory Corruption Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-39426",
"datePublished": "2024-08-14T15:07:32.157Z",
"dateReserved": "2024-06-24T20:32:06.596Z",
"dateUpdated": "2024-08-15T03:55:58.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41830 (GCVE-0-2024-41830)
Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55
VLAI
EPSS
Title
Talos Security Advisory for Adobe (TALOS-2024-2009)
Summary
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-416 - Use After Free (CWE-416)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://helpx.adobe.com/security/products/acrobat… | vendor-advisory |
| https://www.talosintelligence.com/vulnerability_r… |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Adobe | Acrobat Reader |
Affected:
0 , ≤ 24.001.30123
(semver)
|
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(custom)
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat |
Affected:
0 , ≤ 24.001.30123
(semver)
Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30636
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* |
|
| adobe | acrobat_reader |
Affected:
0 , ≤ 20.005.30635
(custom)
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20964
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* |
|
| adobe | acrobat_reader_dc |
Affected:
0 , ≤ 24.002.20991
(semver)
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
Date Public
2024-08-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "20.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30636",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "20.005.30635",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20964",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
],
"defaultStatus": "affected",
"product": "acrobat_reader_dc",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "24.002.20991",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T03:55:59.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-14T16:03:25.773Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2009"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Acrobat Reader",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "24.001.30123",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-08-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free (CWE-416)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T15:07:25.451Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Talos Security Advisory for Adobe (TALOS-2024-2009)"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-41830",
"datePublished": "2024-08-14T15:07:25.451Z",
"dateReserved": "2024-07-22T17:16:40.931Z",
"dateUpdated": "2024-08-15T03:55:59.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…