// For flags

CVE-2021-21069

Adobe Creative Cloud Privilege Escalation Vulnerability

Severity Score

7.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a local privilege escalation vulnerability that could allow an attacker to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require user interaction.

Adobe Creative Cloud Desktop Application versiones 5.3 (y anteriores), está afectada por una vulnerabilidad de escalada de privilegios local que podría permitir a un atacante llamar funciones contra el instalador para llevar a cabo acciones con altos privilegios. Una explotación de este problema no requiere una interacción del usuario

This vulnerability allows local attackers to escalate privileges on affected installations of Adobe Creative Cloud on Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Adobe privileged helper tool. The issue lies in the lack of proper validation of the helper clients. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

*Credits: rookuu
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-18 CVE Reserved
  • 2021-03-12 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-10-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
 Creative Cloud Desktop Application
Search vendor "Adobe" for product "Creative Cloud Desktop Application"
 <= 5.3
Search vendor "Adobe" for product "Creative Cloud Desktop Application" and version " <= 5.3"
-
Affected
in Apple
Search vendor "Apple"
 Macos
Search vendor "Apple" for product "Macos"
--
Safe
Adobe
Search vendor "Adobe"
 Creative Cloud Desktop Application
Search vendor "Adobe" for product "Creative Cloud Desktop Application"
 <= 5.3
Search vendor "Adobe" for product "Creative Cloud Desktop Application" and version " <= 5.3"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe