CVE-2021-28581 Adobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalation
An attacker can escalate privileges on a local machine by exploiting an uncontrolled search path vulnerability in Adobe Creative Cloud Desktop.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-28581?
CVE-2021-28581 is a high-severity vulnerability in Adobe Creative Cloud (desktop component), published on 8 Sep 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitation of this issue requires user interaction in that a victim must log on to the attacker's local machine.
Weakness: CWE-427
Which versions are affected by CVE-2021-28581?
It affects 1 product.
Products include Adobe Creative Cloud.
How do I fix CVE-2021-28581?
No fix has been published for CVE-2021-28581 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-28581 being exploited?
There is no known exploitation of CVE-2021-28581 in the wild and no public exploit code.
Other vulnerabilities in Adobe Creative Cloud (desktop component)
- CVE-2020-9669 Privilege escalation in Adobe Creative Cloud Desktop Application
- CVE-2019-8236 Privilege escalation in Adobe Creative Cloud Desktop application
- CVE-2019-7958 Privilege escalation in Creative Cloud Desktop Application
- CVE-2019-7959 Supply chain in Creative Cloud Desktop Application
- CVE-2018-12829 Security feature bypass in Adobe Creative Cloud Desktop Application before 4.6.1
Sources
Also known as GHSA-64hj-4677-7p5v.