Vulnerability · Published Jun 28, 2021 · Assigned by adobe

CVE-2021-28579Adobe Connect improper access control could lead to privilege escalation

Medium 4.3

In plain English

A medium-severity improper access control in Connect from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.1%top 34.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker with 'Learner' permissions can leverage this scenario to access the list of event participants.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Connect	unspecified – through 11.2.1unspecified – through None

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://helpx.adobe.com/security/products/connect/apsb21-36.html x_refsource_MISC