Vulnerability-Lookup

WID-SEC-W-2023-2921

Vulnerability from csaf_certbund - Published: 2023-11-14 23:00 - Updated: 2023-11-14 23:00

Summary

Adobe Creative Cloud: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Adobe Creative Cloud umfasst Anwendungen und Dienste für Video, Design, Fotografie und Web.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe Creative Cloud ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - UNIX - Linux - MacOS X - Windows

CVE-2023-47073

CVE-2023-47072

CVE-2023-47071

CVE-2023-47070

CVE-2023-47069

CVE-2023-47068

CVE-2023-47067

CVE-2023-47066

CVE-2023-47060

CVE-2023-47059

CVE-2023-47058

CVE-2023-47057

CVE-2023-47056

CVE-2023-47055

CVE-2023-47054

CVE-2023-47053

CVE-2023-47052

CVE-2023-47051

CVE-2023-47050

CVE-2023-47049

CVE-2023-47048

CVE-2023-47047

CVE-2023-47046

CVE-2023-47044

CVE-2023-47043

CVE-2023-47042

CVE-2023-47041

CVE-2023-47040

CVE-2023-44355

CVE-2023-44353

CVE-2023-44352

CVE-2023-44351

CVE-2023-44350

CVE-2023-44347

CVE-2023-44346

CVE-2023-44345

CVE-2023-44344

CVE-2023-44343

CVE-2023-44342

CVE-2023-44341

CVE-2023-44329

CVE-2023-44328

CVE-2023-44327

CVE-2023-44326

CVE-2023-44325

CVE-2023-44324

CVE-2023-26368

CVE-2023-26347

References

13 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://helpx.adobe.com/security/products/premier…	external
https://helpx.adobe.com/security/products/media-e…	external
https://helpx.adobe.com/security/products/indesig…	external
https://helpx.adobe.com/security/products/incopy/…	external
https://helpx.adobe.com/security/products/framema…	external
https://helpx.adobe.com/security/products/dimensi…	external
https://helpx.adobe.com/security/products/coldfus…	external
https://helpx.adobe.com/security/products/bridge/…	external
https://helpx.adobe.com/security/products/auditio…	external
https://helpx.adobe.com/security/products/animate…	external
https://helpx.adobe.com/security/products/after_e…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Adobe Creative Cloud umfasst Anwendungen und Dienste f\u00fcr Video, Design, Fotografie und Web.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe Creative Cloud ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2921 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2921.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2921 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2921"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-65 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/premiere_pro/apsb23-65.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-63 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/media-encoder/apsb23-63.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-55 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/indesign/apsb23-55.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-60 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/incopy/apsb23-60.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-58 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/framemaker/apsb23-58.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-62 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/dimension/apsb23-62.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-52 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-57 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-64 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/audition/apsb23-64.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-61 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/animate/apsb23-61.html"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB23-66 vom 2023-11-14",
        "url": "https://helpx.adobe.com/security/products/after_effects/apsb23-66.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Adobe Creative Cloud: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-11-14T23:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T16:55:44.511+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2023-2921",
      "initial_release_date": "2023-11-14T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-11-14T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud After Effects \u003c 24.0.3",
                "product": {
                  "name": "Adobe Creative Cloud After Effects \u003c 24.0.3",
                  "product_id": "T031123",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:after_effects_24.0.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud After Effects \u003c 23.6.2",
                "product": {
                  "name": "Adobe Creative Cloud After Effects \u003c 23.6.2",
                  "product_id": "T031124",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:after_effects_23.6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Animate \u003c 23.0.3",
                "product": {
                  "name": "Adobe Creative Cloud Animate \u003c 23.0.3",
                  "product_id": "T031125",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:animate_23.0.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Animate \u003c 24.0",
                "product": {
                  "name": "Adobe Creative Cloud Animate \u003c 24.0",
                  "product_id": "T031126",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:animate_24.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Audition \u003c 24.0",
                "product": {
                  "name": "Adobe Creative Cloud Audition \u003c 24.0",
                  "product_id": "T031127",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:audition_24.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Audition \u003c 23.6.1",
                "product": {
                  "name": "Adobe Creative Cloud Audition \u003c 23.6.1",
                  "product_id": "T031128",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:audition_23.6.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Bridge\u202f \u003c 13.0.5",
                "product": {
                  "name": "Adobe Creative Cloud Bridge\u202f \u003c 13.0.5",
                  "product_id": "T031129",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:bridge_13.0.5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Bridge\u202f \u003c 14.0.1",
                "product": {
                  "name": "Adobe Creative Cloud Bridge\u202f \u003c 14.0.1",
                  "product_id": "T031130",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:bridge_14.0.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Coldfusion 2023 \u003c Update 6",
                "product": {
                  "name": "Adobe Creative Cloud Coldfusion 2023 \u003c Update 6",
                  "product_id": "T031131",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2023_update_6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Coldfusion 2021 \u003c Update 12",
                "product": {
                  "name": "Adobe Creative Cloud Coldfusion 2021 \u003c Update 12",
                  "product_id": "T031132",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2021_update_12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Dimension \u003c 3.4.10",
                "product": {
                  "name": "Adobe Creative Cloud Dimension \u003c 3.4.10",
                  "product_id": "T031135",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:dimension_3.4.10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud FrameMaker Publishing Server Version 2022 \u003c Update 1",
                "product": {
                  "name": "Adobe Creative Cloud FrameMaker Publishing Server Version 2022 \u003c Update 1",
                  "product_id": "T031138",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:framemaker_publishing_server_version_2022_update_1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud InCopy\u202f \u003c\u202f19.0",
                "product": {
                  "name": "Adobe Creative Cloud InCopy\u202f \u003c\u202f19.0",
                  "product_id": "T031139",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:incopy19.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud InCopy\u202f\u202f\u003c 18.5.1",
                "product": {
                  "name": "Adobe Creative Cloud InCopy\u202f\u202f\u003c 18.5.1",
                  "product_id": "T031140",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:incopy18.5.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud InDesign \u003c ID19.0",
                "product": {
                  "name": "Adobe Creative Cloud InDesign \u003c ID19.0",
                  "product_id": "T031141",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:indesign_id19.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud InDesign \u003c ID18.5.1",
                "product": {
                  "name": "Adobe Creative Cloud InDesign \u003c ID18.5.1",
                  "product_id": "T031142",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:indesign_id18.5.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Media Encoder \u003c 24.0.3",
                "product": {
                  "name": "Adobe Creative Cloud Media Encoder \u003c 24.0.3",
                  "product_id": "T031143",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:media_encoder_24.0.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Media Encoder \u003c 23.6.2",
                "product": {
                  "name": "Adobe Creative Cloud Media Encoder \u003c 23.6.2",
                  "product_id": "T031144",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:media_encoder_23.6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Premiere Pro \u003c 23.6.2",
                "product": {
                  "name": "Adobe Creative Cloud Premiere Pro \u003c 23.6.2",
                  "product_id": "T031145",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:premiere_pro_23.6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Adobe Creative Cloud Premiere Pro \u003c 24.0.3",
                "product": {
                  "name": "Adobe Creative Cloud Premiere Pro \u003c 24.0.3",
                  "product_id": "T031146",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:creative_cloud:premiere_pro_24.0.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Creative Cloud"
          }
        ],
        "category": "vendor",
        "name": "Adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-47073",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47073"
    },
    {
      "cve": "CVE-2023-47072",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47072"
    },
    {
      "cve": "CVE-2023-47071",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47071"
    },
    {
      "cve": "CVE-2023-47070",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47070"
    },
    {
      "cve": "CVE-2023-47069",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47069"
    },
    {
      "cve": "CVE-2023-47068",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47068"
    },
    {
      "cve": "CVE-2023-47067",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47067"
    },
    {
      "cve": "CVE-2023-47066",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47066"
    },
    {
      "cve": "CVE-2023-47060",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47060"
    },
    {
      "cve": "CVE-2023-47059",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47059"
    },
    {
      "cve": "CVE-2023-47058",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47058"
    },
    {
      "cve": "CVE-2023-47057",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47057"
    },
    {
      "cve": "CVE-2023-47056",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47056"
    },
    {
      "cve": "CVE-2023-47055",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47055"
    },
    {
      "cve": "CVE-2023-47054",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47054"
    },
    {
      "cve": "CVE-2023-47053",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47053"
    },
    {
      "cve": "CVE-2023-47052",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47052"
    },
    {
      "cve": "CVE-2023-47051",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47051"
    },
    {
      "cve": "CVE-2023-47050",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47050"
    },
    {
      "cve": "CVE-2023-47049",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47049"
    },
    {
      "cve": "CVE-2023-47048",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47048"
    },
    {
      "cve": "CVE-2023-47047",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47047"
    },
    {
      "cve": "CVE-2023-47046",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47046"
    },
    {
      "cve": "CVE-2023-47044",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47044"
    },
    {
      "cve": "CVE-2023-47043",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47043"
    },
    {
      "cve": "CVE-2023-47042",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47042"
    },
    {
      "cve": "CVE-2023-47041",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47041"
    },
    {
      "cve": "CVE-2023-47040",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-47040"
    },
    {
      "cve": "CVE-2023-44355",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44355"
    },
    {
      "cve": "CVE-2023-44353",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44353"
    },
    {
      "cve": "CVE-2023-44352",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44352"
    },
    {
      "cve": "CVE-2023-44351",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44351"
    },
    {
      "cve": "CVE-2023-44350",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44350"
    },
    {
      "cve": "CVE-2023-44347",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44347"
    },
    {
      "cve": "CVE-2023-44346",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44346"
    },
    {
      "cve": "CVE-2023-44345",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44345"
    },
    {
      "cve": "CVE-2023-44344",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44344"
    },
    {
      "cve": "CVE-2023-44343",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44343"
    },
    {
      "cve": "CVE-2023-44342",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44342"
    },
    {
      "cve": "CVE-2023-44341",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44341"
    },
    {
      "cve": "CVE-2023-44329",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44329"
    },
    {
      "cve": "CVE-2023-44328",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44328"
    },
    {
      "cve": "CVE-2023-44327",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44327"
    },
    {
      "cve": "CVE-2023-44326",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44326"
    },
    {
      "cve": "CVE-2023-44325",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44325"
    },
    {
      "cve": "CVE-2023-44324",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-44324"
    },
    {
      "cve": "CVE-2023-26368",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-26368"
    },
    {
      "cve": "CVE-2023-26347",
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-26347"
    }
  ]
}

CVE-2023-26347 (GCVE-0-2023-26347)

Vulnerability from cvelistv5 – Published: 2023-11-17 13:31 – Updated: 2024-10-21 14:17

Title

CVE-2023-38205 issues | ColdFusion Admin Panel Access

Summary

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:28 UTC

CWE

CWE-284 - Improper Access Control (CWE-284)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/coldfus…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	ColdFusion	Affected: 0 , ≤ 2021.11 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.614Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26347",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:28:45.976291Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T14:17:57.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "ColdFusion",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "2021.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "NETWORK",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control (CWE-284)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-17T13:31:33.156Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2023-38205 issues | ColdFusion Admin Panel Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-26347",
    "datePublished": "2023-11-17T13:31:33.156Z",
    "dateReserved": "2023-02-22T19:47:52.374Z",
    "dateUpdated": "2024-10-21T14:17:57.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26368 (GCVE-0-2023-26368)

Vulnerability from cvelistv5 – Published: 2023-11-16 15:45 – Updated: 2024-09-04 20:43

Title

Adobe InCopy Out-of-Bounds Read Vulnerability v1.0

Summary

Adobe InCopy versions 18.5 (and earlier) and 17.4.2 (and earlier) are affected by are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-14 21:35 UTC

CWE

CWE-125 - Out-of-bounds Read (CWE-125)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/incopy/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Adobe	InCopy	Affected: 0 , ≤ 17.4.2 (semver)
adobe	incopy	Affected: 0 , ≤ 17.4.2 (semver) cpe:2.3:a:adobe:incopy:-:::::::*

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.478Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/incopy/apsb23-60.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:adobe:incopy:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "incopy",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "17.4.2",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-14T21:35:08.353944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:43:07.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "InCopy",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "17.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe InCopy versions 18.5 (and earlier) and 17.4.2 (and earlier) are affected by are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read (CWE-125)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-16T15:45:10.495Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/incopy/apsb23-60.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Adobe InCopy Out-of-Bounds Read Vulnerability v1.0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-26368",
    "datePublished": "2023-11-16T15:45:10.495Z",
    "dateReserved": "2023-02-22T19:47:52.380Z",
    "dateUpdated": "2024-09-04T20:43:07.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44324 (GCVE-0-2023-44324)

Vulnerability from cvelistv5 – Published: 2023-11-17 12:27 – Updated: 2024-11-25 21:01

Title

ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability

Summary

Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this issue does not require user interaction.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-06 19:32 UTC

CWE

CWE-287 - Improper Authentication (CWE-287)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/framema…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	Adobe Framemaker Publishing Server	Affected: 0 , ≤ v2022 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:52.103Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/framemaker-publishing-server/apsb23-58.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44324",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-06T19:32:50.067286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-25T21:01:04.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Adobe Framemaker Publishing Server",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "v2022",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin\u0027s password. Exploitation of this issue does not require user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "NETWORK",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication (CWE-287)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-15T16:38:35.947Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/framemaker-publishing-server/apsb23-58.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44324",
    "datePublished": "2023-11-17T12:27:08.996Z",
    "dateReserved": "2023-09-28T16:25:40.448Z",
    "dateUpdated": "2024-11-25T21:01:04.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44325 (GCVE-0-2023-44325)

Vulnerability from cvelistv5 – Published: 2023-11-17 08:26 – Updated: 2024-08-02 19:59

Title

ZDI-CAN-21666: Adobe Animate FLA File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Summary

Adobe Animate versions 23.0.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-125 - Out-of-bounds Read (CWE-125)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/animate…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	Animate	Affected: 0 , ≤ 23.0.2 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:52.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/animate/apsb23-61.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Animate",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "23.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Animate versions 23.0.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read (CWE-125)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-17T08:26:35.746Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/animate/apsb23-61.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ZDI-CAN-21666: Adobe Animate FLA File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44325",
    "datePublished": "2023-11-17T08:26:35.746Z",
    "dateReserved": "2023-09-28T16:25:40.448Z",
    "dateUpdated": "2024-08-02T19:59:52.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44326 (GCVE-0-2023-44326)

Vulnerability from cvelistv5 – Published: 2023-11-17 08:49 – Updated: 2024-08-02 19:59

Title

ZDI-CAN-21866: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Summary

Adobe Dimension versions 3.4.9 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-125 - Out-of-bounds Read (CWE-125)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/dimensi…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	Dimension	Affected: 0 , ≤ 3.4.9 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:51.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/dimension/apsb23-62.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Dimension",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "3.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Dimension versions 3.4.9 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read (CWE-125)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-17T08:49:46.970Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/dimension/apsb23-62.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ZDI-CAN-21866: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44326",
    "datePublished": "2023-11-17T08:49:46.970Z",
    "dateReserved": "2023-09-28T16:25:40.448Z",
    "dateUpdated": "2024-08-02T19:59:51.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44327 (GCVE-0-2023-44327)

Vulnerability from cvelistv5 – Published: 2023-11-16 14:32 – Updated: 2025-06-11 14:08

Title

ZDI-CAN-21793: Adobe Bridge MP4 File Uninitialized Variable Information Disclosure Vulnerability

Summary

Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-11 14:07 UTC

CWE

CWE-824 - Access of Uninitialized Pointer (CWE-824)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/bridge/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	Bridge	Affected: 0 , ≤ 14.0.0 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:52.138Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-11T14:07:52.461393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-11T14:08:08.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Bridge",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "14.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "Access of Uninitialized Pointer (CWE-824)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-04T15:39:09.218Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ZDI-CAN-21793: Adobe Bridge MP4 File Uninitialized Variable Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44327",
    "datePublished": "2023-11-16T14:32:44.041Z",
    "dateReserved": "2023-09-28T16:25:40.448Z",
    "dateUpdated": "2025-06-11T14:08:08.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44328 (GCVE-0-2023-44328)

Vulnerability from cvelistv5 – Published: 2023-11-16 14:32 – Updated: 2024-08-02 19:59

Title

ZDI-CAN-21797: Adobe Bridge MP4 File Parsing Use-After-Free Information Disclosure Vulnerability

Summary

Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-416 - Use After Free (CWE-416)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/bridge/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	Bridge	Affected: 0 , ≤ 14.0.0 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:52.120Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Bridge",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "14.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free (CWE-416)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-04T15:48:44.521Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ZDI-CAN-21797: Adobe Bridge MP4 File Parsing Use-After-Free Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44328",
    "datePublished": "2023-11-16T14:32:44.846Z",
    "dateReserved": "2023-09-28T16:25:40.448Z",
    "dateUpdated": "2024-08-02T19:59:52.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44329 (GCVE-0-2023-44329)

Vulnerability from cvelistv5 – Published: 2023-11-16 14:32 – Updated: 2024-08-02 19:59

Title

ZDI-CAN-21798: Adobe Bridge MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-824 - Access of Uninitialized Pointer (CWE-824)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/bridge/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	Bridge	Affected: 0 , ≤ 14.0.0 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:51.991Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Bridge",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "14.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "Access of Uninitialized Pointer (CWE-824)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-04T15:42:57.637Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/bridge/apsb23-57.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ZDI-CAN-21798: Adobe Bridge MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44329",
    "datePublished": "2023-11-16T14:32:46.016Z",
    "dateReserved": "2023-09-28T16:25:40.448Z",
    "dateUpdated": "2024-08-02T19:59:51.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44341 (GCVE-0-2023-44341)

Vulnerability from cvelistv5 – Published: 2023-11-16 10:11 – Updated: 2024-08-02 20:07

Title

Adobe InDesign CC 2023 Memory Corruption Vulnerability I

Summary

Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-29 17:27 UTC

CWE

CWE-476 - NULL Pointer Dereference (CWE-476)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/indesig…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	InDesign Desktop	Affected: 0 , ≤ ID18.5 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-29T17:27:29.515771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:19:22.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:32.162Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/indesign/apsb23-55.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "InDesign Desktop",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "ID18.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference (CWE-476)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-16T10:11:18.407Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/indesign/apsb23-55.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Adobe InDesign CC 2023 Memory Corruption Vulnerability I"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44341",
    "datePublished": "2023-11-16T10:11:18.407Z",
    "dateReserved": "2023-09-28T16:25:40.450Z",
    "dateUpdated": "2024-08-02T20:07:32.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44342 (GCVE-0-2023-44342)

Vulnerability from cvelistv5 – Published: 2023-11-16 10:11 – Updated: 2024-08-02 20:07

Title

Adobe InDesign CC 2023 Memory Corruption Vulnerability II.

Summary

Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-29 14:40 UTC

CWE

CWE-125 - Out-of-bounds Read (CWE-125)

Assigner

adobe mitre root Scorecard

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/indesig…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Adobe	InDesign Desktop	Affected: 0 , ≤ ID18.5 (semver)

Date Public

2023-11-14 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44342",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-29T14:40:36.494120Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:19:37.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:32.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/indesign/apsb23-55.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "InDesign Desktop",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "ID18.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read (CWE-125)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-16T10:11:14.888Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/indesign/apsb23-55.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Adobe InDesign CC 2023 Memory Corruption Vulnerability II."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2023-44342",
    "datePublished": "2023-11-16T10:11:14.888Z",
    "dateReserved": "2023-09-28T16:25:40.450Z",
    "dateUpdated": "2024-08-02T20:07:32.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2023-2921

CVE-2023-26347 (GCVE-0-2023-26347)

CVE-2023-26368 (GCVE-0-2023-26368)

CVE-2023-44324 (GCVE-0-2023-44324)

CVE-2023-44325 (GCVE-0-2023-44325)

CVE-2023-44326 (GCVE-0-2023-44326)

CVE-2023-44327 (GCVE-0-2023-44327)

CVE-2023-44328 (GCVE-0-2023-44328)

CVE-2023-44329 (GCVE-0-2023-44329)

CVE-2023-44341 (GCVE-0-2023-44341)

CVE-2023-44342 (GCVE-0-2023-44342)

Tags

Sightings

Nomenclature

Related by attack behaviour