PT-2018-1330 · Adobe · Dreamweaver

Publicado 2018-05-13 · Atualizado 2018-06-22 · CVE-2018-4924

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dreamweaver CC versions 18.0 and earlier

Description The issue is related to an OS Command Injection vulnerability in the HTML editor of Adobe Dreamweaver CC, which is caused by the failure to neutralize special elements used in operating system commands. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Recommendations For Adobe Dreamweaver CC versions 18.0 and earlier, update to a version later than 18.0 to resolve the issue. As a temporary workaround, consider restricting the use of the HTML editor until a patch is available.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2018-00828

CVE-2018-4924

Produtos afetados

Dreamweaver

Referências · 6

• https://helpx.adobe.com/security/products/dreamweaver/apsb18-07.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-4924 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00828 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-4924 · Nota de Segurança
• http://securitytracker.com/id/1040516 · Nota
• http://securityfocus.com/bid/103395 · Nota