PT-2021-4167 · Adobe · Acrobat Reader
Published
2021-07-13
·
Updated
2023-09-12
·
CVE-2021-28644
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Acrobat Reader DC versions 2021.005.20054 and earlier
Acrobat Reader DC versions 2020.004.30005 and earlier
Acrobat Reader DC versions 2017.011.30197 and earlier
Description
A path traversal vulnerability affects Adobe Acrobat and Reader, allowing an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. This issue requires user interaction, where a victim must open a malicious file, specifically a specially crafted PDF file, to exploit the vulnerability. The vulnerability is related to incorrect restriction of a pathname to a directory with limited access.
Recommendations
For Acrobat Reader DC versions 2021.005.20054 and earlier, update to a version later than 2021.005.20054 to resolve the issue.
For Acrobat Reader DC versions 2020.004.30005 and earlier, update to a version later than 2020.004.30005 to resolve the issue.
For Acrobat Reader DC versions 2017.011.30197 and earlier, update to a version later than 2017.011.30197 to resolve the issue.
As a temporary workaround, consider avoiding the use of
PDF files from untrusted sources until a patch is available.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Acrobat Reader