Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide malicious XML input containing a reference to an external entity, leading to unauthorized read access to the file system. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Adobe |
|
| Apple |
|
| Microsoft |
|
Configuration 1 [-]
| AND |
|
No data.
References
History
Tue, 07 Jan 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. This vulnerability allows an attacker to provide malicious XML input containing a reference to an external entity, leading to data disclosure or potentially code execution. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document. | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide malicious XML input containing a reference to an external entity, leading to unauthorized read access to the file system. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document. |
Wed, 18 Dec 2024 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Adobe
Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Adobe acrobat Reader Dc Apple Apple macos Microsoft Microsoft windows |
|
| CPEs | cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| Vendors & Products |
Adobe
Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Adobe acrobat Reader Dc Apple Apple macos Microsoft Microsoft windows |
Tue, 10 Dec 2024 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 10 Dec 2024 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. This vulnerability allows an attacker to provide malicious XML input containing a reference to an external entity, leading to data disclosure or potentially code execution. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document. | |
| Title | Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | |
| Weaknesses | CWE-611 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: adobe
Published: 2024-12-10T19:54:08.271Z
Updated: 2025-01-07T18:03:09.684Z
Reserved: 2024-10-15T15:35:47.031Z
Link: CVE-2024-49535
Vulnrichment
Updated: 2024-12-10T20:40:36.363Z
NVD
Status : Modified
Published: 2024-12-10T20:15:18.923
Modified: 2025-01-07T18:15:18.843
Link: CVE-2024-49535
Redhat
No data.