by Kastro
Paper/Archive/CVE-2024-54032

CVE-2024-54032

Adobe Adobe Connect — Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 0.8%CVSS 9.3
critical.is priorityof 100
39
CVSS 9.3 (CNA, NVD agree)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 57.4.574 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

Affected

ProductAffectedFixed inSource
Adobe Connect≤ 11.4.7–CNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/connect/apsb24-99.html