CVE-2024-30300CWE-200

Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker

Critical · published June 13, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

🔥 A privilege escalation vulnerability in Adobe Framemaker Publishing Server is lurking in versions up to 2022.2, and it’s a critical concern for security! Think of it like a sneaky warehouse employee who has found a backdoor into the security system — one wrong move, and they can access confidential files without anyone noticing. This flaw allows an attacker to exploit sensitive information, potentially leading to unauthorized access and the ability to manipulate user or system privileges. Imagine the chaos of someone rummaging through your private files and having full control over your systems all without a single interaction from the user!

Put simply

Think of it like a sneaky warehouse employee who has found a backdoor into the security system — one wrong move, and they can access confidential files without anyone noticing. This information exposure vulnerability (CWE-200) in Adobe Framemaker Publishing Server allows attackers to gain access to sensitive information and escalate privileges without needing any user interaction, making it a prime target for exploitation.

What to do

This flaw allows an attacker to exploit sensitive information, potentially leading to unauthorized access and the ability to manipulate user or system privileges. Imagine the chaos of someone rummaging through your private files and having full control over your systems all without a single interaction from the user! To safeguard your systems, urgently patch to the latest version of Adobe Framemaker Publishing Server. Ensure you’ve updated to version 2022.3 or later to close this loophole, also review your user privileges and access logs for any suspicious activity. You've got this! By taking action now, you'll fortify your defense against this sneaky vulnerability! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00733 · 53.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-06-13T11:24Z
EPSS history
Timeline
  • 13 JUN 11:24Z
    Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker
    cvelistv5