CVE-2023-22274: high-severity vulnerability in Adobe RoboHelp
ZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.5%
Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Adobe · RoboHelpRelated CVEs — Adobe RoboHelp
In the same product, most dangerous first.
CVE-2023-22273HIGHZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.9%CVE-2021-21070MEDIUMPrivilege Escalation Vulnerability in Adobe RoboHelpEPSS 1.6%CVE-2022-30670HIGHEscalate Privileges to Server Admin - Robohelp ServerEPSS 1.5%CVE-2023-22272HIGHZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure VulnerabilityEPSS 1.4%CVE-2023-22275HIGHZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure VulnerabilityEPSS 1.3%CVE-2023-22268MEDIUMZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure VulnerabilityEPSS 1.2%