CVE-2021-36061: medium-severity vulnerability in Adobe Connect
Adobe Connect Violation of Secure Design Principles Vulnerability Can Lead To Editing Or Deleting Recordings
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Adobe Connect has a flaw that allows someone without authentication to edit or delete recordings if they receive a specially crafted link. An attacker could manipulate a recording parameter to perform unauthorized modifications.
CVE-2021-36061 exploits improper validation of the 'pbMode' parameter in Adobe Connect 11.2.2 and earlier, allowing unauthenticated attackers to modify or delete recordings. The attack requires social engineering to distribute a malicious link to a victim, but no prior authentication or special system access is needed.
In the same product, most dangerous first.