PT-2022-18907 · Adobe · Acrobat Reader

Published 2022-04-12 · Updated 2022-05-19 · CVE-2022-28244

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Acrobat Reader DC versions 22.001.20085 and earlier Acrobat Reader DC versions 20.005.3031x and earlier Acrobat Reader DC versions 17.012.30205 and earlier

Description The issue is related to a violation of secure design principles through bypassing the content security policy. This could allow an attacker to send arbitrarily configured requests to the cross-origin attack target domain. Exploitation requires user interaction, where the victim needs to access a crafted PDF file on an attacker's server.

Recommendations For versions 22.001.20085 and earlier, update to a version that addresses the secure design principles violation. For versions 20.005.3031x and earlier, update to a version that addresses the secure design principles violation. For versions 17.012.30205 and earlier, update to a version that addresses the secure design principles violation. As a temporary workaround, consider restricting access to crafted PDF files from untrusted sources until a patch is available.

Fix

Weakness Enumeration

CWE-657

Related Identifiers

CVE-2022-28244

Affected Products

Acrobat Reader

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-28244 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb22-16.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28244 · Vendor Advisory
• https://t.me/cibsecurity/42427 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28244 · Note