CVE Details for CVE: CVE-2021-40719
Summary
Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF messages are deserialized on an Adobe Connect server. An attacker can leverage this to execute remote code execution on the server.
Timestamps
Last major update 30-11-2021 - 20:22
Published 21-10-2021 - 20:15
Last modified 30-11-2021 - 20:22
Vulnerable Configurations
  • cpe:2.3:a:adobe:connect:-:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:-:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:1.0.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:1.0.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:6.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:6.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:6.3:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:7.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:7.3:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:7.5:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:8.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:8.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:8.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:8.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:8.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:8.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.3:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.5.7:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.5.7:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.6:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.6:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.7:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.7:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.8:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.8:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:9.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:9.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.5:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.5:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.6:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.6:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:10.8:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:10.8:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.0:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.2:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:adobe:connect:11.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:adobe:connect:11.2.2:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
  • An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
CWE
CVSS
Base
7.5
Impact
6.4
Exploitability
10.0
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
CVSS3
Base
9.8
Impact
5.9
Exploitability
3.9
Access
Attack ComplexityAttack vectorPrivileges RequiredScopeUser Interaction
LOW NETWORK NONE UNCHANGED NONE
Impact
ConfidentialityIntegrityAvailability
HIGH HIGH HIGH
VIA4 references
cvss-vector via4
AV:N/AC:L/Au:N/C:P/I:P/A:P
cvss3-vector via4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H