CVE-2021-21085

Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports and opens the data on their local machine.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://helpx.adobe.com/security/products/connect/apsb21-19.html	Vendor Advisory
https://helpx.adobe.com/security/products/connect/apsb21-19.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:47

Type	Values Removed	Values Added
References	~~() https://helpx.adobe.com/security/products/connect/apsb21-19.html - Vendor Advisory~~	() https://helpx.adobe.com/security/products/connect/apsb21-19.html - Vendor Advisory

Information

Published : 2021-03-12 19:15

Updated : 2024-11-21 05:47

NVD link : CVE-2021-21085

Mitre link : CVE-2021-21085

CVE.ORG link : CVE-2021-21085

JSON object : View

Products Affected

adobe

connect

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2021-21085", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-03-12T19:15:14.927", "references": [{"url": "https://helpx.adobe.com/security/products/connect/apsb21-19.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "https://helpx.adobe.com/security/products/connect/apsb21-19.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports and opens the data on their local machine."}, {"lang": "es", "value": "La versi\u00f3n 11.0.7 de Adobe Connect (y anteriores) se ve afectada por una vulnerabilidad de Validaci\u00f3n de Entradas en la funci\u00f3n de exportaci\u00f3n. Un atacante podr\u00eda aprovechar esta vulnerabilidad inyectando una carga \u00fatil en un formulario de eventos en l\u00ednea y lograr la ejecuci\u00f3n de c\u00f3digo si la v\u00edctima exporta y abre los datos en su m\u00e1quina local"}], "lastModified": "2024-11-21T05:47:32.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C32AEC65-EFAE-4DAF-9C74-DBA28E61B21A", "versionEndIncluding": "11.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}