Skip to content
OpenAdvisories
High NCSC-2024-0483 19 CVEs

Kwetsbaarheden verholpen in Adobe Connect

Published Dec 11, 2024 · Updated Dec 11, 2024 · nl

Vendor: Adobe Product: Adobe Connect Product: Connect

Summary

Adobe heeft kwetsbaarheden verholpen in Adobe Connect (Versies 12.6, 11.4.7 en eerder).

Details

Interpretaties
De kwetsbaarheden omvatten zowel opgeslagen als gereflecteerde Cross-Site Scripting (XSS) die aanvallers in staat stellen om kwaadaardige scripts in te voegen en uit te voeren in de browsers van gebruikers. Dit kan leiden tot ongeautoriseerde acties in de context van de sessie van het slachtoffer, wat gevolgen kan hebben voor de integriteit en vertrouwelijkheid van gebruikersdata. Daarnaast is er een kwetsbaarheid voor onjuiste toegangscontrole die aanvallers in staat stelt om beveiligingsmaatregelen te omzeilen, wat kan leiden tot ongeautoriseerde toegang tot gevoelige informatie zonder enige gebruikersinteractie.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 19

  • Critical 9.3
    CVE-2024-54032

    Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s b…

    Adobe Adobe Connect
  • Critical 9.3
    CVE-2024-54034

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within…

    Adobe Adobe Connect
  • Critical 9.3
    CVE-2024-54036

    Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s b…

    Adobe Adobe Connect
  • High 8.1
    CVE-2024-54037

    Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-49550

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54042

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54043

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54044

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54045

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54046

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54047

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54048

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54049

    Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54050

    Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires use…

    Adobe Adobe Connect
  • Medium 6.1
    CVE-2024-54051

    Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires use…

    Adobe Adobe Connect
  • Medium 5.4
    CVE-2024-54039

    Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s b…

    Adobe Adobe Connect
  • Medium 5.4
    CVE-2024-54040

    Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s b…

    Adobe Adobe Connect
  • Medium 5.4
    CVE-2024-54041

    Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s b…

    Adobe Adobe Connect
  • Medium 4.3
    CVE-2024-54038

    Adobe Connect | Improper Access Control (CWE-284)

    Adobe Connect versions 12.6, 11.4.7 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low imp…

    Adobe Adobe Connect

Revision history

  1. #0

    Initiele versie

References