Description
Adobe Connect versions 12.8 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Adobe Connect | ≤ 12.8 | — |
Advisories 1
- WID-SEC-2025-1044 Adobe Connect: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Rechteerweiterung BSI CERT-Bund (WID) · May 13, 2025
References
- https://helpx.adobe.com/security/products/connect/apsb25-36.html vendor-advisory