Vulnerability identifier: #VU9193

Vulnerability risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-11291

CWE-ID: CWE-918

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Adobe Connect
Client/Desktop applications / Other client software

Vendor: Adobe

Description
The vulnerability allows a remote user to perform SSRF attack.

The weakness exists due to unknown error. A remote attacker can perform SSRF attack to bypass network access controls, perform unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.

Mitigation
Update to version 9.7.

Vulnerable software versions

Adobe Connect: 9.4.1 - 9.6.2

---

External links
http://helpx.adobe.com/security/products/connect/apsb17-35.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.