Lucene search

[email protected]NVD:CVE-2021-39855

HistorySep 29, 2021 - 4:15 p.m.

CVE-2021-39855

2021-09-2916:15:10

CWE-200

[email protected]

web.nvd.nist.gov

acrobat reader

activex control

information disclosure

vulnerability

ntlmv2 credentials

exploitation

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

70.1%

JSON

Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.

Affected configurations

Nvd

Node

adobeacrobatRange17.011.30059–17.011.30199classic

adobeacrobat_readerRange17.011.30059–17.011.30199classic

AND

applemacosMatch-

microsoftwindowsMatch-

Node

adobeacrobatRange20.001.30005–20.004.30006classic

adobeacrobat_readerRange20.001.30005–20.004.30006classic

AND

applemacosMatch-

microsoftwindowsMatch-

Node

adobeacrobat_dcRange15.008.20082–21.005.20058continuous

adobeacrobat_reader_dcRange15.008.20082–21.005.20058continuous

AND

applemacosMatch-

Node

adobeacrobat_dcRange15.008.20082–21.005.20060continuous

adobeacrobat_reader_dcRange15.008.20082–21.005.20060continuous

AND

microsoftwindowsMatch-

VendorProductVersionCPE
adobeacrobat*cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*
adobeacrobat_reader*cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*
applemacos-cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
adobeacrobat_dc*cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*
adobeacrobat_reader_dc*cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*

Vendor	Product	Version	CPE
adobe	acrobat	*	cpe:2.3:a:adobe:acrobat:::::classic:::*
adobe	acrobat_reader	*	cpe:2.3:a:adobe:acrobat_reader:::::classic:::*
apple	macos	-	cpe:2.3:o:apple:macos:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
adobe	acrobat_dc	*	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
adobe	acrobat_reader_dc	*	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*