CVE-2020-24439 - Vulnerability Details

Vendors	Products
Adobe	Acrobat Acrobat Dc Acrobat Reader Acrobat Reader Dc
Apple	Macos
Microsoft	Windows

Link	Providers
https://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Type	Values Removed	Values Added
Title	Acrobat Reader DC for macOS Signature Validation Bypass	Acrobat Reader DC for macOS Signature Validation Bypass

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Acrobat Reader", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2017.011.30175", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "2020.012.20048", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "2020.001.30005", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "None", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2020-11-03T00:00:00", "descriptions": [{"lang": "en", "value": "Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature (CWE-347)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-06-11T17:31:01", "orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://helpx.adobe.com/security/products/acrobat/apsb20-67.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Acrobat Reader DC for macOS Signature Validation Bypass", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@adobe.com", "DATE_PUBLIC": "2020-11-03T23:00:00.000Z", "ID": "CVE-2020-24439", "STATE": "PUBLIC", "TITLE": "Acrobat Reader DC for macOS Signature Validation Bypass"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Acrobat Reader", "version": {"version_data": [{"version_affected": "<=", "version_value": "2017.011.30175"}, {"version_affected": "<=", "version_value": "2020.012.20048"}, {"version_affected": "<=", "version_value": "2020.001.30005"}, {"version_affected": "<=", "version_value": "None"}]}}]}, "vendor_name": "Adobe"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process."}]}, "impact": {"cvss": {"attackComplexity": "Low", "attackVector": "Local", "availabilityImpact": "None", "baseScore": 2.2, "baseSeverity": "Low", "confidentialityImpact": "None", "integrityImpact": "Low", "privilegesRequired": "Low", "scope": "Unchanged", "userInteraction": "Required", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Verification of Cryptographic Signature (CWE-347)"}]}]}, "references": {"reference_data": [{"name": "https://helpx.adobe.com/security/products/acrobat/apsb20-67.html", "refsource": "MISC", "url": "https://helpx.adobe.com/security/products/acrobat/apsb20-67.html"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:12:08.980Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://helpx.adobe.com/security/products/acrobat/apsb20-67.html"}]}]}, "cveMetadata": {"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "cveId": "CVE-2020-24439", "datePublished": "2020-11-05T19:32:50.010168Z", "dateReserved": "2020-08-19T00:00:00", "dateUpdated": "2024-09-17T00:42:15.886Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Acrobat Reader (string)

vendor : Adobe (string)

versions : [ »

0 : { »

lessThanOrEqual : 2017.011.30175 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

1 : { »

lessThanOrEqual : 2020.012.20048 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

2 : { »

lessThanOrEqual : 2020.001.30005 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

3 : { »

lessThanOrEqual : None (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

datePublic : 2020-11-03T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 2.8 (number)

baseSeverity : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-347 (string)

description : Improper Verification of Cryptographic Signature (CWE-347) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-06-11T17:31:01 (string)

orgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

shortName : adobe (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://helpx.adobe.com/security/products/acrobat/apsb20-67.html (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : Acrobat Reader DC for macOS Signature Validation Bypass (string)

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@adobe.com (string)

DATE_PUBLIC : 2020-11-03T23:00:00.000Z (string)

ID : CVE-2020-24439 (string)

STATE : PUBLIC (string)

TITLE : Acrobat Reader DC for macOS Signature Validation Bypass (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Acrobat Reader (string)

version : { »

version_data : [ »

0 : { »

version_affected : <= (string)

version_value : 2017.011.30175 (string)

}

1 : { »

version_affected : <= (string)

version_value : 2020.012.20048 (string)

}

2 : { »

version_affected : <= (string)

version_value : 2020.001.30005 (string)

}

3 : { »

version_affected : <= (string)

version_value : None (string)

}

]

}

]

}

vendor_name : Adobe (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process. (string)

}

]

}

impact : { »

cvss : { »

attackComplexity : Low (string)

attackVector : Local (string)

availabilityImpact : None (string)

baseScore : 2.2 (number)

baseSeverity : Low (string)

confidentialityImpact : None (string)

integrityImpact : Low (string)

privilegesRequired : Low (string)

scope : Unchanged (string)

userInteraction : Required (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Improper Verification of Cryptographic Signature (CWE-347) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://helpx.adobe.com/security/products/acrobat/apsb20-67.html (string)

refsource : MISC (string)

url : https://helpx.adobe.com/security/products/acrobat/apsb20-67.html (string)

}

]

}

source : { »

discovery : EXTERNAL (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T15:12:08.980Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://helpx.adobe.com/security/products/acrobat/apsb20-67.html (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

assignerShortName : adobe (string)

cveId : CVE-2020-24439 (string)

datePublished : 2020-11-05T19:32:50.010168Z (string)

dateReserved : 2020-08-19T00:00:00 (string)

dateUpdated : 2024-09-17T00:42:15.886Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*", "matchCriteriaId": "FFF9FEEB-BA17-484C-BC81-A19A5363F06F", "versionEndIncluding": "20.001.30005", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*", "matchCriteriaId": "F942D471-C285-496A-908B-45E5BCC66B50", "versionEndIncluding": "17.011.30175", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*", "matchCriteriaId": "5D8BEE5A-4D08-4EC1-8126-5ADDF8E315BE", "versionEndIncluding": "20.012.20048", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*", "matchCriteriaId": "35912D0F-9492-47B3-A1B8-6D88115FF599", "versionEndIncluding": "20.001.30005", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*", "matchCriteriaId": "FF5AF6C5-A98F-4A45-A757-E652B7A1F5AB", "versionEndIncluding": "17.011.30175", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*", "matchCriteriaId": "FD0E32F7-E377-41D5-A10C-5EB041FD02D4", "versionEndIncluding": "20.012.20048", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process."}, {"lang": "es", "value": "Acrobat Reader DC para macOS versiones 2020.012.20048 (y anteriores), 2020.001.30005 (y anteriores) y 2017.011.30175 (y anteriores) est\u00e1n afectados por una omisi\u00f3n de la caracter\u00edstica de seguridad.&#xa0;Si bien el impacto pr\u00e1ctico en la seguridad es m\u00ednimo, ha sido implementada una soluci\u00f3n de defensa en profundidad para fortalecer a\u00fan m\u00e1s el proceso de actualizaci\u00f3n de Adobe Reader"}], "id": "CVE-2020-24439", "lastModified": "2024-11-21T05:14:49.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.2, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 1.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 1.4, "source": "psirt@adobe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-05T20:15:17.037", "references": [{"source": "psirt@adobe.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/acrobat/apsb20-67.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/acrobat/apsb20-67.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : FFF9FEEB-BA17-484C-BC81-A19A5363F06F (string)

versionEndIncluding : 20.001.30005 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : F942D471-C285-496A-908B-45E5BCC66B50 (string)

versionEndIncluding : 17.011.30175 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* (string)

matchCriteriaId : 5D8BEE5A-4D08-4EC1-8126-5ADDF8E315BE (string)

versionEndIncluding : 20.012.20048 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : 35912D0F-9492-47B3-A1B8-6D88115FF599 (string)

versionEndIncluding : 20.001.30005 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : FF5AF6C5-A98F-4A45-A757-E652B7A1F5AB (string)

versionEndIncluding : 17.011.30175 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* (string)

matchCriteriaId : FD0E32F7-E377-41D5-A10C-5EB041FD02D4 (string)

versionEndIncluding : 20.012.20048 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 387021A0-AF36-463C-A605-32EA7DAC172E (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2572D17-1DE6-457B-99CC-64AFD54487EA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process. (string)

}

1 : { »

lang : es (string)

value : Acrobat Reader DC para macOS versiones 2020.012.20048 (y anteriores), 2020.001.30005 (y anteriores) y 2017.011.30175 (y anteriores) están afectados por una omisión de la característica de seguridad. Si bien el impacto práctico en la seguridad es mínimo, ha sido implementada una solución de defensa en profundidad para fortalecer aún más el proceso de actualización de Adobe Reader (string)

}

]

id : CVE-2020-24439 (string)

lastModified : 2024-11-21T05:14:49.747 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : LOW (string)

cvssData : { »

accessComplexity : HIGH (string)

accessVector : LOCAL (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 1.2 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:L/AC:H/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 1.9 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 2.8 (number)

baseSeverity : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.3 (number)

impactScore : 1.4 (number)

source : psirt@adobe.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 2.8 (number)

baseSeverity : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.3 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-11-05T20:15:17.037 (string)

references : [ »

0 : { »

source : psirt@adobe.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/acrobat/apsb20-67.html (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/acrobat/apsb20-67.html (string)

}

]

sourceIdentifier : psirt@adobe.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-347 (string)

}

]

source : psirt@adobe.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Local

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Local

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object