CVE-2021-21055

Adobe Dreamweaver versions 21.0 (and earlier) and 20.2 (and earlier) is affected by an untrusted search path vulnerability that could result in information disclosure. An attacker with physical access to the system could replace certain configuration files and dynamic libraries that Dreamweaver references, potentially resulting in information disclosure.

CVSS v3 6.2 MEDIUM
CVSS v2.0 2.1 LOW

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html	Vendor Advisory
https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:dreamweaver::::::::
	cpe:2.3:a:adobe:dreamweaver:21.0:::::::*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

21 Nov 2024, 05:47

Type	Values Removed	Values Added
References	~~() https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html - Vendor Advisory~~	() https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html - Vendor Advisory

Information

Published : 2021-02-11 21:15

Updated : 2024-11-21 05:47

NVD link : CVE-2021-21055

Mitre link : CVE-2021-21055

CVE.ORG link : CVE-2021-21055

JSON object : View

Products Affected

apple

macos

microsoft

windows

adobe

dreamweaver

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2021-21055", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.3}]}, "published": "2021-02-11T21:15:13.383", "references": [{"url": "https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "Adobe Dreamweaver versions 21.0 (and earlier) and 20.2 (and earlier) is affected by an untrusted search path vulnerability that could result in information disclosure. An attacker with physical access to the system could replace certain configuration files and dynamic libraries that Dreamweaver references, potentially resulting in information disclosure."}, {"lang": "es", "value": "Adobe Dreamweaver versiones 21.0 (y anteriores) y versiones 20.2 (y anteriores), est\u00e1n afectadas por una vulnerabilidad de ruta de b\u00fasqueda no confiable que podr\u00eda resultar en una divulgaci\u00f3n de informaci\u00f3n. Un atacante con acceso f\u00edsico al sistema podr\u00eda reemplazar determinados archivos de configuraci\u00f3n y bibliotecas din\u00e1micas a las que hace referencia Dreamweaver, resultando potencialmente en una divulgaci\u00f3n de informaci\u00f3n"}], "lastModified": "2024-11-21T05:47:28.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:dreamweaver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7D52BDC-7020-4542-9CF4-5B5D51EA9CF7", "versionEndIncluding": "20.2"}, {"criteria": "cpe:2.3:a:adobe:dreamweaver:21.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68E8F9A9-CC0B-457D-ADF6-DB1E86D0EE1F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}