Patch days / November 2020

Adobe Security Updates — November 2020

Tuesday, 10 November 2020

Vulnerabilities: 11
Critical: 1
High: 1
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 9.1
CVE-2020-24407 Arbitrary code execution via file import functionality
EPSS 5.3%

All vulnerabilities 11

Critical1 Show

Critical 9.1
CVE-2020-24407 Arbitrary code execution via file import functionality
EPSS 5.3%

High1 Show

High 7.1
CVE-2020-24400 SQL injection allows arbitrary read from database
EPSS 2.3%

Medium6 Show

Medium 6.5
CVE-2020-24401 Incorrect permissions following the deletion of a user role or deactivation of a user
EPSS 2.2%
Medium 6.1
CVE-2020-24442 Reflected Cross-Site Scripting (XSS) in Adobe Connect
EPSS 1.5%
Medium 6.1
CVE-2020-24443 Reflected Cross-Site Scripting (XSS) in Adobe Connect
EPSS 1.5%
Medium 5.5
CVE-2020-24441 Improper Access Control in Adobe Acrobat Reader for Android
EPSS 2.3%
Medium 4.9
CVE-2020-24402 Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
EPSS 1.7%
Medium 4.3
CVE-2020-24405 Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data
EPSS 1.4%

Low3 Show

Low 3.7
CVE-2020-24406 Document root path disclosure on Maintenance page
EPSS 2%
Low 2.7
CVE-2020-24403 Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
EPSS 1.5%
Low 2.7
CVE-2020-24404 Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
EPSS 1.8%