Description
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Adobe Connect | ≤ 11.4.7 | — |
Advisories 2
- NCSC-2024-0483 Kwetsbaarheden verholpen in Adobe Connect NCSC-NL (Netherlands) · Dec 11, 2024
- WID-SEC-2024-3677 Adobe Creative Cloud Applikationen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 10, 2024
References
- https://helpx.adobe.com/security/products/connect/apsb24-99.html vendor-advisory