PT-2018-1330 · Adobe · Dreamweaver

Published 2018-05-13 · Updated 2018-06-22 · CVE-2018-4924

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dreamweaver CC versions 18.0 and earlier

Description The issue is related to an OS Command Injection vulnerability in the HTML editor of Adobe Dreamweaver CC, which is caused by the failure to neutralize special elements used in operating system commands. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Recommendations For Adobe Dreamweaver CC versions 18.0 and earlier, update to a version later than 18.0 to resolve the issue. As a temporary workaround, consider restricting the use of the HTML editor until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2018-00828

CVE-2018-4924

Affected Products

Dreamweaver

References · 6

• https://helpx.adobe.com/security/products/dreamweaver/apsb18-07.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-4924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00828 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-4924 · Security Note
• http://securitytracker.com/id/1040516 · Note
• http://securityfocus.com/bid/103395 · Note