PT-2021-6908 · Microsoft+1 · Internet Explorer+2
Published
2021-09-14
·
Updated
2021-10-07
·
CVE-2021-39857
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 and earlier
Adobe Acrobat Reader DC add-on for Internet Explorer versions 2020.004.30006 and earlier
Adobe Acrobat Reader DC add-on for Internet Explorer versions 2017.011.30199 and earlier
Adobe Acrobat 2017 and earlier
Adobe Acrobat Reader 2017 and earlier
Adobe Acrobat 2020 and earlier
Adobe Acrobat Reader 2020 and earlier
Description
The issue is related to an information disclosure vulnerability that could allow an unauthenticated attacker to check for the existence of local files by leveraging user interaction, such as visiting an attacker-controlled web page. This vulnerability may enable a remote attacker to gain unauthorized access to protected information.
Recommendations
For Adobe Acrobat Reader DC add-on for Internet Explorer version 2021.005.20060 and earlier, update to a version later than 2021.005.20060.
For Adobe Acrobat Reader DC add-on for Internet Explorer version 2020.004.30006 and earlier, update to a version later than 2020.004.30006.
For Adobe Acrobat Reader DC add-on for Internet Explorer version 2017.011.30199 and earlier, update to a version later than 2017.011.30199.
For Adobe Acrobat 2017 and earlier, update to a version later than 2017.
For Adobe Acrobat Reader 2017 and earlier, update to a version later than 2017.
For Adobe Acrobat 2020 and earlier, update to a version later than 2020.
For Adobe Acrobat Reader 2020 and earlier, update to a version later than 2020.
As a temporary workaround, consider restricting access to sensitive local files until a patch is available.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Acrobat
Acrobat Reader
Internet Explorer