CVE-2021-28581: high-severity vulnerability in Adobe Creative Cloud (desktop component)
Adobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.9%
Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitation of this issue requires user interaction in that a victim must log on to the attacker's local machine.
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Adobe · Creative Cloud (desktop component)Related CVEs — Adobe Creative Cloud (desktop component)
In the same product, most dangerous first.
CVE-2020-24422HIGHUncontrolled Search Path in Creative Cloud Desktop ApplicationEPSS 3.1%CVE-2021-21069HIGHAdobe Creative Cloud Privilege Escalation VulnerabilityEPSS 2.6%CVE-2022-23202HIGHAdobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code executionEPSS 2.2%CVE-2021-43019HIGHAdobe Creative Cloud Incorrect Permission Assignment Privilege Escalation VulnerabilityEPSS 2.2%CVE-2021-21078MEDIUMAdobe Creative Cloud Unquoted Service Path in CCXProcessEPSS 1.1%CVE-2021-21068MEDIUMAdobe Creative Cloud installer arbitrary file overwrite vulnerabilityEPSS 0.6%