Adobe Security Bulletin

Security update available for Adobe Connect | APSB23-33

Bulletin ID

Date Published

Priority

APSB23-33

September 12, 2023

3

Summary

Adobe has released a security update for Adobe Connect. This update resolves important vulnerabilities. Successful exploitation could lead to arbitrary code execution.

Affected product versions

Product

Version

Platform

Adobe Connect

12.3  and earlier versions            

All

Solution

Adobe categorizes these updates with the following  priority ratings and recommends users update their installation to the latest version.

Product

Version

Platform

Priority

Availability

Adobe Connect

12.4.1

All

3

Vulnerability details

Vulnerability Category

Vulnerability Impact

Severity

CVSS base score 

CVE Number

Cross-site Scripting (Reflected XSS) (CWE-79)

Arbitrary code execution

Important

4.7

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CVE-2023-29305

Cross-site Scripting (Reflected XSS) (CWE-79)

Arbitrary code execution

Important

4.7

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CVE-2023-29306

Acknowledgments

Adobe would like to thank the following researchers for reporting these issue and for working with Adobe to help protect our customers:   

  • Iskander Rehouma (pretorian) - CVE-2023-29305
  • Nitescu Lucian (luciann) - CVE-2023-29306

NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.


For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com.

 Adobe

Get help faster and easier

New user?