Vulnerability · Published Nov 23, 2021 · Assigned by adobe
CVE-2021-43019Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability
High 7.8
In plain English
A high-severity incorrect permission assignment in Creative Cloud (desktop component) from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Official description
Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Creative Cloud (desktop component) | unspecified – through 5.5unspecified – through None |
Weakness: CWE-732 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H