PT-2022-2344 · Adobe · Creative Cloud Desktop

Published 2022-02-08 · Updated 2022-02-24 · CVE-2022-23202

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud Desktop version 2.7.0.13 and earlier

Description The issue is related to an uncontrolled search path element in the Adobe Creative Cloud Desktop Application, which could allow an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction, where a victim must download a malicious DLL file. The attacker must deliver the DLL to the same folder as the installer, making it a high complexity attack vector.

Recommendations For Adobe Creative Cloud Desktop version 2.7.0.13 and earlier, update to a version later than 2.7.0.13 to resolve the issue. As a temporary workaround, consider restricting the execution of files from untrusted sources and avoid downloading DLL files from unknown locations. Restrict access to the installer folder to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2022-02592

CVE-2022-23202

Affected Products

Creative Cloud Desktop

References · 5

• https://osv.dev/vulnerability/CVE-2022-23202 · Vendor Advisory
• https://helpx.adobe.com/security/products/creative-cloud/apsb22-11.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23202 · Security Note
• https://bdu.fstec.ru/vul/2022-02592 · Security Note
• https://t.me/cibsecurity/37614 · Telegram Post