CVE-2021-21080 Adobe Connect Reflected Cross-site Scripting via query parameter
An attacker can inject malicious JavaScript into Adobe Connect via a query parameter, executing code in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-21080?
CVE-2021-21080 is a medium-severity cross-site scripting vulnerability in Adobe Connect, published on 12 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.
Weakness: CWE-79
Which versions are affected by CVE-2021-21080?
It affects 1 product.
Products include Adobe Connect.
How do I fix CVE-2021-21080?
No fix has been published for CVE-2021-21080 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-21080 being exploited?
There is no known exploitation of CVE-2021-21080 in the wild and no public exploit code.
Other vulnerabilities in Adobe Connect
- CVE-2017-11291 Server-side request forgery in Adobe Connect 9.6.2 and earlier versions
- CVE-2026-75682 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- CVE-2023-4661 SQLi in Saphira Connect
- CVE-2023-4662 RCE in Saphira Connect
- CVE-2021-40719 Adobe Connect Deserialization of Untrusted Data Remote Code Execution
Sources
Also known as GHSA-32xg-2hj3-q32w.