PT-2021-6633 · Adobe · Photoshop Elements

Published 2021-06-08 · Updated 2022-10-18 · CVE-2021-28597

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Adobe Photoshop Elements versions 5.2 and earlier

Description The issue is related to the creation of temporary files with insecure permissions in Adobe Photoshop Elements. An unauthenticated attacker could exploit this to call functions against the installer, allowing them to perform high-privileged actions. Exploitation does not require user interaction.

Recommendations For Adobe Photoshop Elements versions 5.2 and earlier, update to a version that addresses the insecure temporary file creation vulnerability to prevent potential privilege escalation. As a temporary workaround, consider restricting access to the installer to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-379

CWE-668

Related Identifiers

BDU:2022-01949

CVE-2021-28597

Affected Products

Photoshop Elements

References · 5

• https://bdu.fstec.ru/vul/2022-01949 · Security Note
• https://helpx.adobe.com/security/products/photoshop_elements/apsb21-46.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28597 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28597 · Vendor Advisory
• https://t.me/cvenotify/17002 · Telegram Post