PT-2022-2370 · Adobe · Acrobat+5

Published 2022-01-11 · Updated 2022-01-21 · CVE-2021-44714

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to the fixed version Adobe Acrobat Reader versions prior to the fixed version Adobe Acrobat 2017 versions prior to the fixed version Adobe Acrobat Reader 2017 versions prior to the fixed version Adobe Acrobat 2020 versions prior to the fixed version Adobe Acrobat Reader 2020 versions prior to the fixed version Acrobat Reader DC versions 21.007.20099 and earlier Acrobat Reader DC versions 20.004.30017 and earlier Acrobat Reader DC versions 17.011.30204 and earlier

Description The issue is related to a violation of secure design principles, which could allow an attacker to bypass security features and potentially disclose protected information. In affected versions of Acrobat Reader DC, a warning message is displayed when a user clicks on a PDF file, but this message does not include custom protocols when used by the sender, which could be used by an attacker to mislead the user. User interaction is required to exploit this issue, as the user would need to click 'allow' on the warning message of a malicious file.

Recommendations For Adobe Acrobat and Adobe Acrobat Reader, update to a version that includes the fix for this issue. For Acrobat Reader DC version 21.007.20099 and earlier, update to a version that includes the fix for this issue. For Acrobat Reader DC version 20.004.30017 and earlier, update to a version that includes the fix for this issue. For Acrobat Reader DC version 17.011.30204 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the display of warning messages for custom protocols in Acrobat Reader DC until a patch is available.

Fix

Weakness Enumeration

CWE-657

Related Identifiers

BDU:2022-02708

CVE-2021-44714

Affected Products

Acrobat Reader

Acrobat

Acrobat 2017

Acrobat 2020

Acrobat Reader 2017

Acrobat Reader 2020

References · 5

• https://bdu.fstec.ru/vul/2022-02708 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44714 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb22-01.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44714 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44714 · Note