Multiple Adobe Enterprise products Vulnerable To Code Execution

Multiple Adobe Enterprise products such as Adobe Experience, Premier Pro, ColdFusion, Bridge, Lightroom, and Animate have been discovered with critical code execution vulnerabilities that were associated with Untrusted search path, Cross-site scripting, Out-of-bounds write, Use After free, Heap-based buffer overflow and many others.

Adobe has released multiple security advisories to address these vulnerabilities.

Among all of these products, Adobe Experience Manager had the highest number of vulnerabilities, accounting for 43 code execution vulnerabilities associated with Improper access control and cross-site scripting.

Vulnerability Analysis

According to the reports shared with Cyber Security News, successfully exploiting these vulnerabilities in any Adobe product will lead to arbitrary code execution, allowing a threat actor to perform any malicious activity on the compromised product.

Adobe Animate

This product had four vulnerabilities, three of which were related to memory leaks and one associated with arbitrary code execution (CVE-2024-20761).

This vulnerability exists due to an Out-of-bounds write condition on the Adobe Animate product, which a threat actor could exploit to perform write actions at the end or beginning of the intended buffer.

This vulnerability was given a severity of 7.8 (High).

Adobe Lightroom

This product had only one vulnerability, which was related to arbitrary code execution that exists due to an Untrusted search path.

This vulnerability was assigned with CVE-2024-20754, and its severity has yet to be categorized.

A threat actor could exploit this vulnerability and achieve code execution over the affected product.

Adobe Bridge

This product was discovered with four vulnerabilities in three of which were linked with arbitrary code execution vulnerabilities that existed due to Use after free, heap-based buffer overflow and Out-of-bounds write conditions on the vulnerable products. 

These vulnerabilities were assigned with CVE-2024-20752 (7.8 – High), CVE-2024-20755 (7.8 – High), and CVE-2024-20756 (8.6 – High). 

Adobe ColdFusion

This product was discovered with only one vulnerability that was related to Arbitrary file system read due to improper access control. However, there were no arbitrary code executions present in this product.

The only vulnerability was assigned with CVE-2024-20767 and the severity was given as 8.2 (High). 

Adobe Premiere Pro

This product was discovered with two vulnerabilities both of which were related to arbitrary code execution due to Heap-based buffer overflow and Out-of-bounds write conditions.

These vulnerabilities were assigned with CVE-2024-20745 (7.8 – High) and CVE-2024-20746 (7.8 – High). 

Adobe Experience Manager

As mentioned earlier, this product was the only product with the highest number of vulnerabilities. There were 43 arbitrary code execution vulnerabilities and 3 security bypass vulnerabilities. 

All of the code execution vulnerabilities existed due to Cross-site scripting.

Among the three security bypass vulnerabilities, two of them were due to improper input validation and the other was due to improper access control.

Affected Products

Fixed In Versions