CVE-2021-21085CWE-20

Adobe Connect CSV injection via export feature could lead to code execution

High · published March 12, 2021

CVSS v3.1
7.8
EPSS
4%
Percentile
90.2
In the wild
Unconfirmed
What it is

Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability by injecting a payload into an online event form and achieve code execution if the victim exports and opens the data on their local machine.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03870 · 90.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-03-12T18:14Z
EPSS history
Timeline
  • 12 MAR 18:14Z
    Adobe Connect CSV injection via export feature could lead to code execution
    cvelistv5