Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-1306 — XML External Entity (XXE) Injection in Adobe Acrobat

CWE-611 — XML External Entity (XXE) Injection5 documents5 sources
Severity
7.5HIGHNVD
EPSS
16.1%
top 5.20%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Adobe AcrobatAdobe Acrobat Reader
Timeline
PublishedJun 15
Latest updateMay 1

Description

The Adobe Reader control in Adobe Reader and Acrobat 7.0 and 7.0.1 allows remote attackers to determine the existence of files via Javascript containing XML script, aka the "XML External Entity vulnerability."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDadobe/acrobat_reader7.0, 7.0.1+1
▶NVDadobe/acrobat7.0, 7.0.1+1

Patches

Patch: www.adobe.com ↗Patch: www.securityfocus.com ↗Patch: www.adobe.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-jrv6-p293-phjx: The Adobe Reader control in Adobe Reader and Acrobat 7↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
Adobe Acrobat 7.0 / Adobe Reader 7.0 - File Existence / File Disclosure↗2005-06-15
▶

📋Vendor Advisories

1
Red Hat
CVE-2005-1306: The Adobe Reader control in Adobe Reader and Acrobat 7↗
▶

📐Framework References

1
CWE
Improper Restriction of XML External Entity Reference↗
▶
CVE-2005-1306 — XML External Entity (XXE) Injection | cvebase