PT-2021-2520 · Adobe · Adobe Creative Cloud Desktop Application

Published 2021-03-09 · Updated 2021-12-03 · CVE-2021-21078

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud Desktop Application version 5.3 and earlier

Description The issue is related to an Unquoted Service Path vulnerability in CCXProcess, which could allow an attacker to achieve arbitrary code execution in the process of the current user. Exploitation of this issue requires user interaction. The vulnerability is also associated with incorrect path handling, allowing an attacker to execute arbitrary code.

Recommendations For Adobe Creative Cloud Desktop Application version 5.3 and earlier, update to a version later than 5.3 to resolve the issue. As a temporary workaround, consider restricting access to the CCXProcess to minimize the risk of exploitation.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2021-01923

CVE-2021-21078

Affected Products

Adobe Creative Cloud Desktop Application

References · 6

• https://helpx.adobe.com/security/products/creative-cloud/apsb21-18.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21078 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21078 · Vendor Advisory
• https://t.me/cvenotify/11276 · Telegram Post
• https://t.me/cibsecurity/24875 · Telegram Post