PT-2024-2211 · Adobe · Lightroom Desktop

Published 2024-03-12 · Updated 2024-12-12 · CVE-2024-20754

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lightroom Desktop versions 7.1.2 and earlier

Description The issue is related to an Untrusted Search Path vulnerability. This could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction, specifically that a victim must open a malicious file.

Recommendations For Lightroom Desktop versions 7.1.2 and earlier, update to a version later than 7.1.2 to resolve the issue. At the moment, there is no information about additional mitigation measures.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2024-02138

CVE-2024-20754

Affected Products

Lightroom Desktop

References · 7

• https://helpx.adobe.com/security/products/lightroom/apsb24-17.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20754 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20754 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02138 · Security Note
• https://twitter.com/VulmonFeeds/status/1769830101384913027 · Twitter Post
• https://t.me/cvenotify/103067 · Telegram Post
• https://twitter.com/CVEnew/status/1769777929364385827 · Twitter Post