CVE-2021-44714
Adobe Acrobat Reader Missing Custom Protocols in Warning Message Prompts
- State
- Published
- Severity
- 2.5 Low
- Published
- Jan 14, 2022
- Updated
- Sep 16, 2024
- Reserved
- Dec 7, 2021
Description
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Violation of Secure Design Principles that could lead to a Security feature bypass. Acrobat Reader DC displays a warning message when a user clicks on a PDF file, which could be used by an attacker to mislead the user. In affected versions, this warning message does not include custom protocols when used by the sender. User interaction is required to abuse this vulnerability as they would need to click 'allow' on the warning message of a malicious file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.5 Low | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N | adobe |
Weaknesses
- CWE-657 Violation of Secure Design Principles (CWE-657)
Affected Products
| Product | Versions |
|---|---|
Acrobat ReaderAdobe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.