CVE-2024-45136

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45136", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2024-08-21T23:00:59.349Z", "datePublished": "2024-10-09T14:05:03.366Z", "dateUpdated": "2024-10-09T14:37:20.156Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "InCopy", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "18.5.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2024-10-08T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "InCopy versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue requires user interaction."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "Unrestricted Upload of File with Dangerous Type (CWE-434)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2024-10-09T14:05:03.366Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/incopy/apsb24-79.html"}], "source": {"discovery": "EXTERNAL"}, "title": "InCopy | Unrestricted Upload of File with Dangerous Type (CWE-434)"}, "adp": [{"affected": [{"vendor": "adobe", "product": "incopy", "cpes": ["cpe:2.3:a:adobe:incopy:-:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "18.5.3", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-09T14:36:27.959493Z", "id": "CVE-2024-45136", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-09T14:37:20.156Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45136", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-09T14:36:27.959493Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:adobe:incopy:-:*:*:*:*:*:*:*"], "vendor": "adobe", "product": "incopy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "18.5.3"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-09T14:37:15.519Z"}}], "cna": {"title": "InCopy | Unrestricted Upload of File with Dangerous Type (CWE-434)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modifiedScope": "UNCHANGED", "temporalScore": 7.8, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 7.8, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "InCopy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "18.5.3"}], "defaultStatus": "affected"}], "datePublic": "2024-10-08T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/incopy/apsb24-79.html", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "InCopy versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue requires user interaction."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload of File with Dangerous Type (CWE-434)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2024-10-09T14:05:03.366Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45136", "state": "PUBLISHED", "dateUpdated": "2024-10-09T14:37:20.156Z", "dateReserved": "2024-08-21T23:00:59.349Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2024-10-09T14:05:03.366Z", "assignerShortName": "adobe"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "InCopy", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "18.5.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "psirt@adobe.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:adobe:incopy:-:*:*:*:*:*:*:*"], "defaultStatus": "affected", "product": "incopy", "vendor": "adobe", "versions": [{"lessThanOrEqual": "18.5.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:incopy:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA9F09B4-2963-4ADD-9CD8-50996E95423C", "versionEndExcluding": "18.5.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:incopy:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD0CF9D9-54BB-480D-8BEF-CC170F6C9B4F", "versionEndExcluding": "19.5", "versionStartIncluding": "19.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InCopy versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue requires user interaction."}, {"lang": "es", "value": "Las versiones 19.4, 18.5.3 y anteriores de InCopy se ven afectadas por una vulnerabilidad de carga sin restricciones de archivos de tipo peligroso que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario por parte de un atacante. Un atacante podr\u00eda aprovechar esta vulnerabilidad cargando un archivo malicioso que luego se puede ejecutar en el servidor. Para aprovechar este problema se requiere la interacci\u00f3n del usuario."}], "id": "CVE-2024-45136", "lastModified": "2026-06-17T07:53:38.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45136", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-09T14:36:27.959493Z", "version": "2.0.3"}}]}, "published": "2024-10-09T15:15:13.163", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/incopy/apsb24-79.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{}