by Kastro
Paper/Archive/CVE-2021-40720

CVE-2021-40720

Adobe Ops-CLI — Ops CLI Deserialization of Untrusted Data leads to Abritrary Code Execution

EPSS 10%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.5.955 × 2019.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.

Affected

ProductAffectedFixed inSource
Ops-CLIunspecified – 2.0.4–CNA
Ops-CLIunspecified – None–CNA

Scores by source

adobe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/ops_cli/apsb21-88.html