PT-2021-2307 · Adobe · Acrobat+1

Published 2021-02-09 · Updated 2022-10-21 · CVE-2021-21045

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC versions 2020.013.20074 and earlier Adobe Acrobat Reader DC versions 2020.001.30018 and earlier Adobe Acrobat Reader DC versions 2017.011.30188 and earlier Adobe Acrobat versions prior to the fixed version

Description The issue is related to improper access control in Adobe Reader and Acrobat. It allows a remote attacker to elevate privileges in the context of the current user by using a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to gain elevated privileges.

Recommendations For Adobe Acrobat Reader DC versions 2020.013.20074 and earlier, update to a version later than 2020.013.20074 to resolve the issue. For Adobe Acrobat Reader DC versions 2020.001.30018 and earlier, update to a version later than 2020.001.30018 to resolve the issue. For Adobe Acrobat Reader DC versions 2017.011.30188 and earlier, update to a version later than 2017.011.30188 to resolve the issue. For Adobe Acrobat, update to the fixed version to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-01541

CVE-2021-21045

Affected Products

Acrobat

Acrobat Reader

References · 7

• https://safe-surf.ru/specialists/bulletins-nkcki/661681 · Security Note
• https://bdu.fstec.ru/vul/2021-01541 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb21-09.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21045 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21045 · Vendor Advisory
• https://t.me/cvenotify/9934 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21045 · Note