CVE-2020-24433

Adobe Acrobat Reader DC Local Privilege Escalation via Installer Component

State
Published
Severity
7.8 High
Published
Nov 5, 2020
Updated
Sep 16, 2024
Reserved
Aug 19, 2020

Read the record on cve.org

Description

Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary code as SYSTEM. Exploitation of this issue requires an attacker to socially engineer a victim, or the attacker must already have some access to the environment.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hadobe

Weaknesses

  • CWE-284 Improper Access Control (CWE-284)

Affected Products

ProductVersions
Acrobat ReaderAdobe
  • 2017.011.30175 and earlierAffected
  • 2020.012.20048 and earlierAffected
  • 2020.001.30005 and earlierAffected
  • None and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.