CVE-2021-43019CWE-732

Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability

High · published November 23, 2021

CVSS v3.0
7.8
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02178 · 82.2th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2021-11-23T18:03Z
EPSS history
Timeline
  • 23 NOV 18:03Z
    Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability
    cvelistv5