CVE-2021-44714CWE-657

Adobe Acrobat Reader Missing Custom Protocols in Warning Message Prompts

Low · published January 14, 2022

CVSS v3.1
2.5
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Violation of Secure Design Principles that could lead to a Security feature bypass. Acrobat Reader DC displays a warning message when a user clicks on a PDF file, which could be used by an attacker to mislead the user. In affected versions, this warning message does not include custom protocols when used by the sender. User interaction is required to abuse this vulnerability as they would need to click 'allow' on the warning message of a malicious file.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02554 · 84.9th percentile
Weakness
CWE-657 · Violation of Secure Design Principles
Published
2022-01-14T19:05Z
EPSS history
Timeline
  • 14 JAN 19:05Z
    Adobe Acrobat Reader Missing Custom Protocols in Warning Message Prompts
    cvelistv5