Id:
CVE-2021-28634
Comment
:
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on the host machine in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSSv2 Score:
8.5
Access vector:
|
NETWORK
|
Access complexity:
|
MEDIUM
|
Authentication:
|
SINGLE
|
Confidentiality impact:
|
COMPLETE
|
Integrity impact:
|
COMPLETE
|
Availability impact:
|
COMPLETE
|
CVSSv2 Vector:
AV:N/AC:M/Au:S/C:C/I:C/A:C
CVSSv3 Score:
8.2
Attack vector:
|
LOCAL
|
Attack complexity:
|
LOW
|
Privileges required:
|
LOW
|
User interaction:
|
REQUIRED
|
Scope:
|
CHANGED
|
Confidentiality impact:
|
HIGH
|
Integrity impact:
|
HIGH
|
Availability impact:
|
HIGH
|
CVSSv3 Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References: