Adobe fixes vulnerabilities in Connect and Reader Mobile
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-24441 | Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. This could result in disclosure of sensitive information stored in databases used by the application. Exploitation requires a victim to download and run a malicious application. NVD description · AI analysis pending | 5.5 | 2% |
| — | ||
| CVE-2020-24442 +1 in the same advisory: …24443 | Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. NVD description · AI analysis pending | 6.1 | 1% |
| — |
Full article277 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 10, 2020
Adobe addressed vulnerabilities in its Reader Mobile and Connect products, none of them is rated as critical severity.
Adobe has released security patches to address vulnerabilities in its Reader Mobile and Connect products.
“Adobe has published security bulletins for Adobe Connect (APSB20-69) and Adobe Reader Mobile (APSB20-71). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the relevant bulletin.” reads the security advisory published by the company.
In Connect, Adobe has addressed two important-severity reflected cross-site scripting (XSS) vulnerabilities that could lead arbitrary JavaScript execution in the browser-
| Reflected cross-site scripting | Arbitrary JavaScript execution in the browser | Important | CVE-2020-24442 CVE-2020-24443 |
The flaws have been reported to Adobe by researchers Saulius Pranckevicius from Danske Bank Red Team (CVE-2020-24442) and Shaun Budding (@pudsec) (CVE-2020-24443).
The software giant addressed the flaw with the release of Connect 11.0.5.
In Adobe Reader Mobile for Android, the company addressed an important-severity improper access control flaw, tracked as CVE-2020-24441, that can lead to the disclosure of sensitive information.
The vulnerability was reported to Adobe by the security researcher Pedro Oliveira (@kanytu).
The good news is that the company is not aware of any attacks in the wild exploiting these vulnerabilities.
In early November, Adobe has addressed 14 vulnerabilities in its Acrobat products, including critical flaws that can be exploited by attackers for arbitrary code execution.
The vulnerabilities impact the Windows and macOS versions of Acrobat DC, Acrobat Reader DC, Acrobat 2020, Acrobat Reader 2020, Acrobat 2017, and Acrobat Reader 2017.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Adobe )
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/110723/security/adobe-connect-reader-mobile.html