Vulnerability · Published Oct 21, 2021 · Assigned by adobe

CVE-2021-40719Adobe Connect Deserialization of Untrusted Data Remote Code Execution

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Connect from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.0)9.8Critical

Exploit odds (30 days)3.5%top 10.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF messages are deserialized on an Adobe Connect server. An attacker can leverage this to execute remote code execution on the server.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Connect	unspecified – through 11.2.3unspecified – through None

Weakness: CWE-502 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://helpx.adobe.com/security/products/connect/apsb21-91.html x_refsource_MISC