CVE-2024-54037

Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/connect/apsb24-99.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:connect::::::::
	cpe:2.3:a:adobe:connect::::::::

History

16 Jan 2025, 18:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.3~~	v2 : unknown v3 : 8.1
Summary	(en) Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. This attack is dependent on the victim allowing all popups, increasing the attack complexity.	(en) Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

14 Jan 2025, 22:15

Type	Values Removed	Values Added
Summary	(en) Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.	(en) Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. This attack is dependent on the victim allowing all popups, increasing the attack complexity.

18 Dec 2024, 14:40

Type	Values Removed	Values Added
References	~~() https://helpx.adobe.com/security/products/connect/apsb24-99.html -~~	() https://helpx.adobe.com/security/products/connect/apsb24-99.html - Vendor Advisory
First Time		Adobe Adobe connect
Summary		(es) Las versiones 12.6, 11.4.7 y anteriores de Adobe Connect se ven afectadas por una vulnerabilidad de DOM-based Cross-Site Scripting (XSS) en DOM que un atacante podría aprovechar para ejecutar código arbitrario en el contexto de la sesión del navegador de la víctima. Al manipular un elemento DOM a través de una URL manipulada o de la entrada del usuario, el atacante puede inyectar secuencias de comandos maliciosas que se ejecutan cuando se procesa la página. Este tipo de ataque requiere la interacción del usuario, ya que la víctima tendría que visitar un enlace malicioso o ingresar datos en un formulario comprometido.
CPE		cpe:2.3:a:adobe:connect::::::::

10 Dec 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-10 21:15

Updated : 2025-01-21 17:07

NVD link : CVE-2024-54037

Mitre link : CVE-2024-54037

CVE.ORG link : CVE-2024-54037

JSON object : View

Products Affected

adobe

connect

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

8.1 /10