Description
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Adobe Connect | ≤ 11.4.7 | — |
Advisories 2
- NCSC-2024-0483 Kwetsbaarheden verholpen in Adobe Connect NCSC-NL (Netherlands) · Dec 11, 2024
- WID-SEC-2024-3677 Adobe Creative Cloud Applikationen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 10, 2024
References
- https://helpx.adobe.com/security/products/connect/apsb24-99.html vendor-advisory