Adobe Acrobat Reader DC CSP Bypass Leads To Privilege Escalation

Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a violation of secure design principles through bypassing the content security policy, which could result in an attacker sending arbitrarily configured requests to the cross-origin attack target domain. Exploitation requires user interaction in which the victim needs to access a crafted PDF file on an attacker's server.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

违背安全设计原则

多款Adobe产品安全漏洞

Adobe Acrobat和Adobe Acrobat Reader都是美国奥多比（Adobe）公司的产品。Adobe Acrobat是一套PDF文件编辑和转换工具。Adobe Acrobat Reader是一款PDF查看器。该软件用于打印，签名和注释 PDF。 Adobe Acrobat 和 Adobe Acrobat Reader 存在安全漏洞，该漏洞源于处理PDF文件时出现设计错误而存在的。远程攻击者利用该漏洞诱骗受害者打开特制的PDF文件并访问敏感信息。

N/A

N/A