Headline
CVE-2023-29306: Adobe Security Bulletin
Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser.
Security update available for Adobe Connect | APSB23-33
Bulletin ID
Date Published
Priority
APSB23-33
September 12, 2023
3
Summary
Adobe has released a security update for Adobe Connect. This update resolves important vulnerabilities. Successful exploitation could lead to arbitrary code execution.
Affected product versions
Product
Version
Platform
Adobe Connect
12.3 and earlier versions
All
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the latest version.
Product
Version
Platform
Priority
Availability
Adobe Connect
12.4.1
All
3
Release notes
Vulnerability details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Number
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVE-2023-29305
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVE-2023-29306
Acknowledgments
Adobe would like to thank the following researchers for reporting these issue and for working with Adobe to help protect our customers:
Iskander Rehouma (pretorian) - CVE-2023-29305
Nitescu Lucian (luciann) - CVE-2023-29306
NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.
For more information, visit https://helpx.adobe.com/security.html, or email [email protected].
Related news
Adobe's Patch Tuesday update for September 2023 comes with a patch for a critical actively exploited security flaw in Acrobat and Reader that could permit an attacker to execute malicious code on susceptible systems. The vulnerability, tracked as CVE-2023-26369, is rated 7.8 for severity on the CVSS scoring system and impacts both Windows and macOS versions of Acrobat DC, Acrobat Reader DC,
Adobe's Patch Tuesday update for September 2023 comes with a patch for a critical actively exploited security flaw in Acrobat and Reader that could permit an attacker to execute malicious code on susceptible systems. The vulnerability, tracked as CVE-2023-26369, is rated 7.8 for severity on the CVSS scoring system and impacts both Windows and macOS versions of Acrobat DC, Acrobat Reader DC,