CVE-2021-28588CWE-22

Adobe RoboHelp Server folderId Directory Traversal Remote Code Execution Vulnerability

High · published June 28, 2021

CVSS v3.1
8.8
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

Adobe RoboHelp Server version 2019.0.9 (and earlier) is affected by a Path Traversal vulnerability when parsing a crafted HTTP POST request. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.06215 · 93.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-06-28T14:13Z
EPSS history
Timeline
  • 28 JUN 14:13Z
    Adobe RoboHelp Server folderId Directory Traversal Remote Code Execution Vulnerability
    cvelistv5