CVE-2022-23202
Published: 16 February 2022
Summary
CVE-2022-23202 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Adobe Creative Cloud Desktop Application. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Creative Cloud Desktop version 2.7.0.13 and earlier contains an Uncontrolled Search Path Element vulnerability, tracked as CVE-2022-23202 and assigned CWE-427. The flaw carries a CVSS 3.1 score of 7.0 and can allow arbitrary code execution in the context of the current user when a malicious DLL is loaded during installation or update operations.
An attacker must first place a crafted DLL in the same directory as the Creative Cloud installer and then persuade the victim to run that installer. Successful exploitation therefore requires both local file placement and explicit user interaction, resulting in a high-complexity local attack vector that yields full control over the affected process.
The official Adobe advisory published at https://helpx.adobe.com/security/products/creative-cloud/apsb22-11.html describes the issue and provides remediation guidance for affected Creative Cloud Desktop installations. The associated EPSS score has remained flat at 0.0729 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28292
Vulnerability details
Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…
more
a victim must download a malicious DLL file. The attacker has to deliver the DLL on the same folder as the installer which makes it as a high complexity attack vector.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.