Lucene search

AdobeCVE-2021-28588

HistoryJun 28, 2021 - 3:15 p.m.

CVE-2021-28588

2021-06-2815:15:23

CWE-22

adobe

web.nvd.nist.gov

cve-2021-28588

adobe

robohelp server

path traversal

http

post

arbitrary code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

62.0%

JSON

Adobe RoboHelp Server version 2019.0.9 (and earlier) is affected by a Path Traversal vulnerability when parsing a crafted HTTP POST request. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Affected configurations

Nvd

Vulners

Node

adoberobohelp_serverRange≤2019.0.9

VendorProductVersionCPE
adoberobohelp_server*cpe:2.3:a:adobe:robohelp_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
adobe	robohelp_server	*	cpe:2.3:a:adobe:robohelp_server::::::::

CNA Affected

[
  {
    "product": "RoboHelp Server",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2019.0.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "None",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.zerodayinitiative.com/advisories/ZDI-21-660/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

62.0%

JSON

Related for CVE-2021-28588