CVE-2025-49552

Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a high-privileged attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/connect/apsb25-70.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 12.9 y anteriores de Adobe Connect están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con altos privilegios para ejecutar scripts maliciosos en el navegador de una víctima. La explotación de este problema requiere interacción del usuario, en el sentido de que una víctima debe navegar a una página web manipulada. Un atacante exitoso puede abusar de esto para lograr la toma de control de la sesión, aumentando el impacto en la confidencialidad y la integridad a un nivel alto. El alcance ha cambiado.

Information

Published : 2025-10-14 22:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-49552

Mitre link : CVE-2025-49552

CVE.ORG link : CVE-2025-49552

JSON object : View

Products Affected

adobe

connect

microsoft

windows

apple

macos

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-49552", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49552", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-21T03:55:31.954376Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.7}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Connect", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.9"}], "defaultStatus": "affected"}]}], "published": "2025-10-14T22:15:37.153", "references": [{"url": "https://helpx.adobe.com/security/products/connect/apsb25-70.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a high-privileged attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed."}, {"lang": "es", "value": "Las versiones 12.9 y anteriores de Adobe Connect est\u00e1n afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podr\u00eda ser explotada por un atacante con altos privilegios para ejecutar scripts maliciosos en el navegador de una v\u00edctima. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que una v\u00edctima debe navegar a una p\u00e1gina web manipulada. Un atacante exitoso puede abusar de esto para lograr la toma de control de la sesi\u00f3n, aumentando el impacto en la confidencialidad y la integridad a un nivel alto. El alcance ha cambiado."}], "lastModified": "2026-10-08T12:10:00.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "FE8202C5-1060-4C83-B5D6-ECB75864C63F", "versionEndExcluding": "12.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}