Skip to content
OpenAdvisories
Medium WID-SEC-2023-2920 5 CVEs

Adobe RoboHelp: Mehrere Schwachstellen

Published Nov 14, 2023 · Updated Nov 14, 2023 · de-DE

Vendor: Adobe Product: RoboHelp < RHS 11 Update 5 (11.5) Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe RoboHelp ausnutzen, um Informationen offenzulegen oder beliebigen Programmcode auszuführen.

Product

RoboHelp ist ein Web-basiertes Hilfesystem des Herstellers Adobe.

Vulnerabilities 5

  • High 7.5
    CVE-2023-22272

    ZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure Vulnerability

    Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require user interaction.

    Adobe RoboHelp
  • High 7.5
    CVE-2023-22274

    ZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability

    Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not requir…

    Adobe RoboHelp
  • High 7.5
    CVE-2023-22275

    ZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure Vulnerability

    Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of thi…

    Adobe RoboHelp
  • High 7.2
    CVE-2023-22273

    ZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution Vulnerability

    Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to Remote Code Execution by an admin authenticated attacker. Exploitation of this i…

    Adobe RoboHelp
  • Medium 6.5
    CVE-2023-22268

    ZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure Vulnerability

    Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an low-privileged authenticated attacker. Exploi…

    Adobe RoboHelp

Revision history

  1. #1

    Initiale Fassung

References