CVE-2023-21611
Adobe Acrobat Dc 15.008.20082 – 22.003.20282
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2023-21611 is a high-severity Creation of Temporary File in Directory with Insecure Permissions (CWE-379) vulnerability in Adobe Acrobat Dc. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Cloud Instance Metadata API (T1552.005); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25778
Vulnerability Data
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current…
more
user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 9 hardening rules · 7 OS baselines
V15.4.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.
The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.
The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.
Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.
Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.
Controlling internal connections prevents exposure of resources to unintended internal spheres.
Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.
The control prevents exposure of the media resource to the wrong security sphere.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorizations directly prevents resources from being exposed outside their intended control sphere.
Secure SDLC practices directly prevent developers from writing code that creates temp files in insecure directories.
Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.
Secure system architecture principles include proper file-system permission models that mitigate insecure temp-file creation.
Secure coding standards directly require safe temporary-file creation with restrictive permissions.
Information access restriction policies can limit who may read or list files in shared temporary directories.
Configuration management can enforce secure default permissions on temporary directories.
Requiring owners to manage the full asset life cycle and remove assets from the inventory upon secure disposal helps prevent resources from being inadvertently exposed outside their intended security sphere.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-668
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-379
- V-248823 OL 8 must not have the telnet-server package installed. prevents CWE-668
RHEL 7 (1 rule)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-668
Windows 10 (1 rule)
- V-220967 The Debug programs user right must only be assigned to the Administrators group. prevents CWE-668
Windows 11 (1 rule)
- V-253490 The "Debug programs" user right must only be assigned to the Administrators group. prevents CWE-668
Windows Server 2016 (1 rule)
- V-225079 The Debug programs user right must only be assigned to the Administrators group. prevents CWE-668
Windows Server 2019 (1 rule)
- V-205757 Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. prevents CWE-668
Windows Server 2022 (1 rule)
- V-254500 Windows Server 2022 debug programs user right must only be assigned to the Administrators group. prevents CWE-668