Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)

CVE-2024-54037

Summary

Adobe Connect versions 12.6, 11.4.7, and prior are susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue can be exploited by an attacker through the manipulation of a DOM element via a crafted URL or malicious user input, allowing the execution of arbitrary code within the victim's browser session. To successfully execute this attack, user interaction is necessary; the victim must visit a compromised link or submit data through a manipulated form. The vulnerability's exploitation hinges on the victim permitting all popups, which elevates the complexity of the attack. Attackers leveraging this vulnerability can potentially execute harmful scripts that may lead to session hijacking and compromise sensitive information.

References