AI analysis
Adobe Connect contains a stored Cross-Site Scripting (XSS) flaw in which an attacker injects malicious JavaScript into vulnerable form fields without needing any privileges. When a legitimate user, such as a host or administrator, views the page containing the injected field, the script executes in their browser, potentially allowing the attacker to hijack the victim's session or take actions with elevated access on their account. The CVSS 3.1 base score is 9.3 (critical), driven by the changed scope and high confidentiality and integrity impact, though the attack requires user interaction (the victim must browse to the affected page). Anyone running an affected Adobe Connect deployment, or users of Adobe's hosted Connect service, is potentially impacted, with administrators and meeting hosts being the highest-value targets. There is no known public proof of concept and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.
What to do: Apply the update specified in Adobe's Connect security bulletin (APSB) as soon as it is released, prioritizing on-premises/licensed deployments since Adobe-hosted instances are patched by Adobe. Administrators should audit stored user-supplied content (form submissions, profiles, custom fields, pods) for injected scripts and review logs for suspicious entries, and check whether any host or admin accounts show anomalous activity. As an interim mitigation, restrict who can submit content to the affected fields and consider Content Security Policy enforcement where the deployment allows it.
Estimated exposure
moderate≈ low thousands of internet-exposed Adobe Connect servers, plus users of Adobe's hosted Connect service — Adobe Connect is an enterprise web-conferencing platform with a mix of Adobe-managed SaaS (patched centrally) and a smaller base of self-hosted/on-premises servers that public internet scans typically count in the low thousands; exact…
Description
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.