Vulnerability · Published Mar 22, 2023 · Assigned by adobe
CVE-2023-26358Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability
High 8.6
In plain English
A high-severity security flaw in Creative Cloud (desktop component) from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
Creative Cloud version 5.9.1 (and earlier) is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Creative Cloud (desktop component) | unspecified – through 5.9.1unspecified – through None |
Weakness: CWE-426 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H