Vulnerability · Published Sep 1, 2021 · Assigned by adobe

CVE-2021-36002Adobe Captivate Installer Creation of Temporary File In Directory With Incorrect Permissions Could Lead To Privilege Escalation

Medium 5.0

In plain English

A medium-severity security flaw in Captivate from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.5%top 56.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Adobe Captivate version 11.5.5 (and earlier) is affected by an Creation of Temporary File In Directory With Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. The attacker must plant a malicious file in a particular location of the victim's machine. Exploitation of this issue requires user interaction in that a victim must launch the Captivate Installer.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Captivate	unspecified – through 11.5.5unspecified – through None

Weakness: CWE-379 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

References

https://helpx.adobe.com/security/products/captivate/apsb21-60.html x_refsource_MISC