PT-2024-17736 · Unknown · X1A0He Adobe Downloader

Winslow1984 + 1 · Published 2024-12-19 · Updated 2024-12-19 · CVE-2024-12786

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions X1a0He Adobe Downloader version 1.3.1 and earlier

Description A critical vulnerability was found in the X1a0He Adobe Downloader, affecting the shouldAcceptNewConnection function of the com.x1a0he.macOS.Adobe-Downloader.helper file in the XPC Service component. This leads to improper privilege management. The exploit has been disclosed to the public and may be used, requiring a local approach to attack. It is noted that this product is not affiliated with the company Adobe.

Recommendations For X1a0He Adobe Downloader version 1.3.1 and earlier, as a temporary workaround, consider disabling the shouldAcceptNewConnection function until a patch is available. Restrict access to the XPC Service component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

CVE-2024-12786

Affected Products

X1A0He Adobe Downloader

References · 10

• 🔥 https://winslow1984.com/books/cve-collection/page/adobe-downloader-131-local-privilege-escalation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12786 · Security Note
• https://vuldb.com/?ctiid.288966 · Note
• https://t.me/cvedetector/13337 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869775596131090575 · Twitter Post
• https://t.me/latest_high_impact_cve/1678 · Telegram Post
• https://vuldb.com/?submit.464685 · Note
• https://vuldb.com/?id.288966 · Note
• https://twitter.com/CveFindCom/status/1869767908831674675 · Twitter Post
• https://twitter.com/CVEnew/status/1869764142518980736 · Twitter Post