PT-2023-1944 · Adobe · Adobe Creative Cloud Desktop Application

Published 2023-03-14 · Updated 2023-03-24 · CVE-2023-26358

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud Desktop Application versions 5.9.1 and earlier

Description The issue is related to an untrusted search path in the application, which could allow an attacker to execute arbitrary code, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources, an attacker could modify that path to point to a malicious program, which the targeted application would then execute. This problem extends to any type of critical resource that the application trusts.

Recommendations For Adobe Creative Cloud Desktop Application versions 5.9.1 and earlier, consider restricting access to critical resources until a patch is available. As a temporary workaround, avoid using the application's search path functionality to locate critical resources.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2023-01554

CVE-2023-26358

Affected Products

Adobe Creative Cloud Desktop Application

References · 5

• https://helpx.adobe.com/security/products/creative-cloud/apsb23-21.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26358 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26358 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01554 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023031482 · Note