PT-2024-9516 · Adobe · Connect
Published
2024-12-10
·
Updated
2025-01-21
·
CVE-2024-54037
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Adobe Connect versions 12.6, 11.4.7 and earlier
Description
The issue is related to a DOM-based Cross-Site Scripting (XSS) vulnerability. It could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact.
Recommendations
For Adobe Connect versions 12.6, 11.4.7 and earlier, consider disabling the ability to manipulate DOM elements through crafted URLs or user input until a patch is available. Restrict access to potentially compromised forms and avoid allowing all popups to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Connect