PT-2021-3407 · Adobe · After Effects

Published 2021-05-11 · Updated 2021-09-14 · CVE-2021-28571

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe After Effects versions 18.1 and earlier

Description The issue is related to the failure to neutralize special elements used in operating system commands, which can lead to command injection. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file.

Recommendations For Adobe After Effects versions 18.1 and earlier, consider restricting the use of development and debugging tools for JavaScript scripts until a patch is available. As a temporary workaround, avoid opening malicious files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-03258

CVE-2021-28571

Affected Products

After Effects

References · 7

• https://bdu.fstec.ru/vul/2021-03258 · Security Note
• https://helpx.adobe.com/ee/security/products/after_effects/apsb21-33.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28571 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28571 · Vendor Advisory
• https://t.me/cvenotify/20854 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021051201 · Note
• https://helpx.adobe.com/security/products/after_effects/apsb21-33.html · Note