CVE Published: 27/09/2021 |
CVE Updated: 17/09/2024 |
CVE Year: 2021 Source: adobe |
Vendor: Adobe |
Product: Digital Editions Status : PUBLISHED
CVE-2021-39827 Description
Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary file write vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to write an arbitrary file to the system. User interaction is required before product installation to abuse this vulnerability.
Metrics
CVSS Version: 3.1 |
Base Score: 6.5 MEDIUM Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
l➤ Exploitability Metrics: Attack Vector (AV)* LOCAL Attack Complexity (AC)* LOW Privileges Required (PR)* HIGH User Interaction (UI)* REQUIRED Scope (S)* UNCHANGED
l➤ Impact Metrics: Confidentiality Impact (C)* HIGH Integrity Impact (I)* HIGH Availability Impact (A)* HIGH
Weakness Enumeration (CWE)
CWE-ID: CWE-379 CWE Name: Creation of Temporary File in Directory with Incorrect Permissions (CWE-379) Source: Adobe
Common Attack Pattern Enumeration and Classification (CAPEC)