PT-2021-23720 · Adobe · Creative Cloud

Published 2021-11-23 · Updated 2022-10-26 · CVE-2021-43019

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud version 5.5 and earlier

Description The issue is related to a privilege escalation vulnerability in the resources used by the Setup.exe service. An unauthenticated attacker could exploit this to remove files and escalate privileges under the context of SYSTEM. To exploit this, an attacker must first be able to execute low-privileged code on the target system. User interaction is required before product installation to abuse this vulnerability.

Recommendations For Adobe Creative Cloud version 5.5 and earlier, update to a version later than 5.5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-43019

ZDI-21-1333

Affected Products

Creative Cloud

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-43019 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43019 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1333 · Security Note
• https://helpx.adobe.com/security/products/creative-cloud/apsb21-111.html · Vendor Advisory
• https://t.me/cvenotify/23721 · Telegram Post
• https://t.me/cibsecurity/32875 · Telegram Post
• https://t.me/cvenotify/34820 · Telegram Post
• https://t.me/cvenotify/34441 · Telegram Post