CVE-2022-23202: falha de alta gravidade em Adobe Creative Cloud (desktop component)
Adobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code execution
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7epss 2.2%
Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must download a malicious DLL file. The attacker has to deliver the DLL on the same folder as the installer which makes it as a high complexity attack vector.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Adobe · Creative Cloud (desktop component)CVEs relacionadas — Adobe Creative Cloud (desktop component)
No mesmo produto, das mais perigosas para as menos.
CVE-2020-24422HIGHUncontrolled Search Path in Creative Cloud Desktop ApplicationEPSS 3.1%CVE-2021-21069HIGHAdobe Creative Cloud Privilege Escalation VulnerabilityEPSS 2.6%CVE-2021-43019HIGHAdobe Creative Cloud Incorrect Permission Assignment Privilege Escalation VulnerabilityEPSS 2.2%CVE-2021-21078MEDIUMAdobe Creative Cloud Unquoted Service Path in CCXProcessEPSS 1.1%CVE-2021-28581HIGHAdobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalationEPSS 0.9%CVE-2021-21068MEDIUMAdobe Creative Cloud installer arbitrary file overwrite vulnerabilityEPSS 0.6%