CVE-2022-28244mediumCWE-657

CVE-2022-28244: medium-severity vulnerability in Adobe Acrobat Reader

Adobe Acrobat Reader DC CSP Bypass Leads To Privilege Escalation

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 3.7%
exploitation probability
3.7%top 11% of all CVEs
observed exploitation
nono source reports it
In short

Adobe Acrobat Reader DC has a flaw that allows attackers to bypass security policies designed to prevent unauthorized cross-origin requests. An attacker can trick a user into opening a malicious PDF file, which then sends unwanted requests to other websites on behalf of the victim.

Technical detail

CVE-2022-28244 involves a Content Security Policy (CSP) bypass in Acrobat Reader DC through violation of secure design principles. The attack vector requires user interaction (opening a crafted PDF from an attacker-controlled server) and allows execution of arbitrary cross-origin requests. The impact enables unauthorized actions against third-party domains in the victim's security context.

Summary generated and translated by AI from the official description.
Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a violation of secure design principles through bypassing the content security policy, which could result in an attacker sending arbitrarily configured requests to the cross-origin attack target domain. Exploitation requires user interaction in which the victim needs to access a crafted PDF file on an attacker's server.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
Adobe · Acrobat Reader
Related CVEs — Adobe Acrobat Reader

In the same product, most dangerous first.

CVE-2021-21017HIGHAcrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 86.3%KEVCVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 61.5%KEVCVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 51.9%KEVCVE-2023-26369HIGH[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildEPSS 6.7%KEVCVE-2021-39843HIGHAdobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityEPSS 76.7%CVE-2021-39836HIGHAdobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityEPSS 69.5%
References
https://helpx.adobe.com/security/products/acrobat/apsb22-16.html