PT-2021-5590 · Adobe · Robohelp Server+1

Published 2021-11-09 · Updated 2022-07-21 · CVE-2021-42727

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe RoboHelp Server versions 2020.0.1 and earlier Adobe Bridge versions 11.1.1 and earlier

Description The issue is related to the possibility of uploading arbitrary files outside of the intended directory, potentially allowing a remote attacker to execute arbitrary code in the context of the current user. Exploitation may require user interaction, such as opening a crafted file or navigating to a planted file on the server. The vulnerability is due to insecure handling of crafted files or path traversal.

Recommendations For Adobe RoboHelp Server versions 2020.0.1 and earlier, restrict access to the file upload functionality until a patch is available. For Adobe Bridge versions 11.1.1 and earlier, avoid opening crafted files in Bridge until the issue is resolved. As a temporary workaround, consider disabling the file upload feature in Adobe RoboHelp Server and limiting access to sensitive files in Adobe Bridge until a patch is available.

Fix

Path traversal

Memory Corruption

Weakness Enumeration

CWE-22

CWE-787

Related Identifiers

BDU:2022-00021

CVE-2021-42727

ZDI-21-1305

Affected Products

Bridge

Robohelp Server

References · 7

• https://bdu.fstec.ru/vul/2022-00021 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1305 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42727 · Security Note
• https://helpx.adobe.com/security/products/bridge/apsb21-94.html · Vendor Advisory
• https://t.me/cibsecurity/32791 · Telegram Post
• https://helpx.adobe.com/security/products/robohelp-server/apsb21-87.html · Note