PT-2021-5109 · Adobe · Digital Editions

Published 2021-09-14 · Updated 2021-10-01 · CVE-2021-39826

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Digital Editions versions 4.5.11.187646 and earlier

Description The issue is related to an arbitrary command execution vulnerability. An authenticated attacker could leverage this vulnerability to execute arbitrary commands. User interaction is required to abuse this vulnerability, as a user must open a maliciously crafted .epub file. The vulnerability may also be exploited through a specially crafted link, allowing an attacker to execute arbitrary code.

Recommendations For Adobe Digital Editions versions 4.5.11.187646 and earlier, consider avoiding the use of .epub files from untrusted sources until a patch is available. As a temporary workaround, restrict the opening of .epub files to minimize the risk of exploitation.

Fix

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

BDU:2021-05898

CVE-2021-39826

Affected Products

Digital Editions

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-39826 · Security Note
• https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39826 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05898 · Security Note
• https://t.me/cibsecurity/29510 · Telegram Post