CVE-2021-43017 Adobe Creative Cloud DLL Hijacking Local Application Denial of Service

2021-11-1818:35:31

CWE-379

adobe

www.cve.org

adobe

creative cloud

dll hijacking

local application

denial of service

vulnerability

CVSS3

4.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

23.7%

JSON

Adobe Creative Cloud version 5.5 (and earlier) are affected by an Application denial of service vulnerability in the Creative Cloud Desktop installer. An authenticated attacker with root privileges could leverage this vulnerability to achieve denial of service by planting a malicious file on the victim’s local machine. User interaction is required before product installation to abuse this vulnerability.

CNA Affected

[
  {
    "product": "GoCart",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "5.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "None",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]