Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-49535

Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide malicious XML input containing a reference to an external entity, potentially leading to unauthorized read access outside the Acrobat sandbox. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document.

Published

2024-12-10T20:15:18.923

Last Modified

2025-01-23T18:36:07.750

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.3 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-611
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application adobe acrobat < 20.005.30748 Yes
Application adobe acrobat < 24.001.30225 Yes
Application adobe acrobat_dc < 24.005.20320 Yes
Application adobe acrobat_reader < 20.005.30748 Yes
Application adobe acrobat_reader_dc < 24.005.20320 Yes
Operating System apple macos - No
Operating System microsoft windows - No
References