Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Adobe Acrobat/Reader Exposes Server to Unauthorized File Access

CVE-2024-47579 · published 1 year ago
Summary

Adobe Acrobat and Reader allow an attacker with admin access to upload and download files on the server, potentially reading internal files. This means an attacker can access sensitive information. To fix, apply the latest updates to Adobe Acrobat and Reader.

Original advisory text
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal fi...
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory
Timeline
Published10 Dec 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-47579 · NVD
Track software like this
Free during beta