CVE-2021-28633

CWE-379 CWE-668 — Exposure to Wrong Sphere3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.1%

top 72.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Adobe Creative Cloud (desktop Component)Adobe Creative Cloud Desktop Application

Timeline

PublishedAug 24

Latest updateMay 24

Description

Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Insecure temporary file creation vulnerability. An attacker could leverage this vulnerability to cause arbitrary file overwriting in the context of the current user. Exploitation of this issue requires physical interaction to the system.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitability: 0.2 | Impact: 5.9

Affected Packages2 packages

▶NVDadobe/creative_cloud_desktop_application2.4

▶CVEListV5adobe/creative_cloud_(desktop_component)unspecified — 2.4+1

🔴Vulnerability Details

GHSA

GHSA-g7f3-p5rj-hpx5: Adobe Creative Cloud Desktop Application (installer) version 2↗2022-05-24

▶

CVEList

Adobe Creative Cloud Installer Arbitrary File Write↗2021-08-24

▶