Vulnerability details
CVE-2024-12786
X1a0He Adobe Downloader
X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management
CVSS 4.0
8.5High
Official description
A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.8High | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.8High | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 6.8Medium | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| X1a0He | Adobe Downloader | 1.3.0 | CVEProject cvelistV5 (CNA) |
| X1a0He | Adobe Downloader | 1.3.1 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://vuldb.com/?id.288966 vdb-entrytechnical-description
- https://vuldb.com/?ctiid.288966 signaturepermissions-required
- https://vuldb.com/?submit.464685 third-party-advisory
- https://winslow1984.com/books/cve-collection/page/adobe-downloader-131-local-privilege-escalation exploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-12-19
- Last updated
- 2024-12-20
- State
- Published
- Assigner (CNA)
- VulDB
Exploit prediction (EPSS)
0.21%
Probability of exploitation in 30 days
12.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-269Improper Privilege Management
- CWE-266Incorrect Privilege Assignment