CVE-2024-54036

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-54036
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://helpx.adobe.com/security/products/connect/apsb24-99.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*
History

14 Jan 2025, 22:15

Type Values Removed Values Added
Summary (en) Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. (en) Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
CVSS v2 : unknown
v3 : 8.2 		v2 : unknown
v3 : 9.3

19 Dec 2024, 19:02

Type Values Removed Values Added
References () https://helpx.adobe.com/security/products/connect/apsb24-99.html - () https://helpx.adobe.com/security/products/connect/apsb24-99.html - Vendor Advisory
Summary
  • (es) Las versiones 12.6, 11.4.7 y anteriores de Adobe Connect se ven afectadas por una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que un atacante podría aprovechar para inyectar secuencias de comandos maliciosas en campos de formulario vulnerables. Se puede ejecutar JavaScript malicioso en el navegador de una víctima cuando esta accede a la página que contiene el campo vulnerable.
CPE cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*
First Time Adobe
Adobe connect

10 Dec 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-10 21:15

Updated : 2025-01-15 17:54

NVD link : CVE-2024-54036

Mitre link : CVE-2024-54036

CVE.ORG link : CVE-2024-54036

JSON object : View

Products Affected

adobe

  • connect
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')