CVE-2023-38245

Published: Aug 10, 2023Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: psirt@adobe.com (Secondary)

Description

Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.

Affected (6)

Products: Adobe: Acrobat Dc, Acrobat Reader Dc, Acrobat, Acrobat Reader

4 products

Acrobat Reader Dc

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Adobe Acrobat Dc	From 15.008.20082 to 23.003.20269
Adobe Acrobat Reader Dc	From 15.008.20082 to 23.003.20269

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Adobe Acrobat	From 20.001.30005 to 20.005.30516.10516
Adobe Acrobat Reader	From 20.001.30005 to 20.005.30516.10516

Running on/with	Platform Versions
Apple Macos	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Adobe Acrobat	From 20.001.30005 to 20.005.30514.10514
Adobe Acrobat Reader	From 20.001.30005 to 20.005.30514.10514

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://helpx.adobe.com/security/products/acrobat/apsb23-30.html

Source: psirt@adobe.com

Vendor Advisory

https://helpx.adobe.com/security/products/acrobat/apsb23-30.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.