PT-2015-3176 · Adobe · Connect

Stas Volfus · Published 2015-06-13 · Updated 2016-12-31 · CVE-2015-0343

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe Connect versions prior to 9.4

Description The issue exists due to inadequate protection of the web page structure in Adobe Connect, allowing for the exploitation of a cross-site scripting (XSS) vulnerability. This can enable a remote attacker to inject arbitrary web script or HTML code using query parameters, such as the query parameter in the admin/home/homepage/search endpoint.

Recommendations For Adobe Connect versions prior to 9.4, update to version 9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/home/homepage/search endpoint in the web app to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00546

CVE-2015-0343

Affected Products

Connect

References · 8

• https://bdu.fstec.ru/vul/2016-00546 · Security Note
• https://helpx.adobe.com/adobe-connect/release-note/connect-94-release-notes.html#Issues%20Resolved · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0343 · Security Note
• http://seclists.org/fulldisclosure/2015/Jun/35 · Note
• http://packetstormsecurity.com/files/132269/Adobe-Connect-9.3-Cross-Site-Scripting.html · Note
• http://securitytracker.com/id/1032567 · Note
• http://seclists.org/bugtraq/2015/Jun/61 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0343 · Note