Product:
Adobe Connect
Summary
Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability that could be exploited by a high-privileged attacker to execute malicious scripts in a victim’s browser. Exploitation requires user interaction, as a victim must navigate to a crafted web page. A successful attack can lead to session takeover, significantly impacting confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.3 | CVE-2025-49552 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious web page and entice a victim to visit it. Once the victim interacts with the page, the attacker can execute scripts in the victim’s browser, potentially leading to session hijacking and unauthorized access to sensitive information.
Affected Products
- Adobe Connect 12.9 and earlier: Vulnerable to DOM-based XSS, requiring user interaction for exploitation.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Connect. Additionally, organizations should implement security best practices, such as educating users about the risks of clicking on untrusted links and regularly monitoring for suspicious activity.