VulnerabilityModified

CVE-2021-21045

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper access control vulnerability.

HIGH 8.2EPSS 1.76%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper access control vulnerability. An unauthenticated attacker could leverage this vulnerability to elevate privileges in the context of the current user.

CVSS 3.1: 8.2 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS: 1.76% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: adobe/acrobat · adobe/acrobat dc · adobe/acrobat reader · adobe/acrobat reader dc
Source: psirt@adobe.com

References

https://helpx.adobe.com/security/products/acrobat/apsb21-09.htmlVendor Advisory
https://helpx.adobe.com/security/products/acrobat/apsb21-09.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.