CVE-2023-29320
Adobe Acrobat 20.001.30005 – 20.005.30516.10516
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2023-29320 is a high-severity Violation of Secure Design Principles (CWE-657) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32895
Vulnerability Data
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user by bypassing the API blacklisting…
more
feature. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 5 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Establishing and updating awareness policy promotes adherence to secure design principles through ongoing training, preventing related violations.
Mandating the policy be consistent with laws, standards, and guidelines enforces secure design principles in security governance and oversight.
Deficiencies violating secure design principles are tracked and corrected through planned actions, limiting attacker opportunities from design flaws.
Documenting, disseminating, and periodically reviewing maintenance policies and procedures enforces core secure design principles for system maintenance activities.
Documented policy with defined scope, roles, responsibilities, and periodic review directly enforces secure design principles and management commitment.
Baseline selection enforces adherence to established secure-design principles rather than ad-hoc or insufficient control choices.
Requires risk determinations for architecture/design decisions, tailoring rationale, and alignment with enterprise architecture to avoid violations of secure design principles.
Regular SSP updates force review of whether the system's evolving design continues to follow documented secure design principles after changes.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly mandates integration of secure development practices including design principles across the SDLC.
Establishes risk-management policy that can embed secure design expectations at the organizational level.
Explicitly requires incorporating least privilege, one key secure design principle.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles are the explicit embodiment of the secure design principles violated by CWE-657.
A secure development life cycle directly requires adherence to established secure design principles.
Security testing can detect violations of secure design principles before release.
Embedding security in project management helps enforce secure design principles from the outset.
Secure coding practices help realize secure design principles at implementation time.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-657
Ubuntu 24.04 (1 rule)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-657
Windows Server 2016 (2 rules)
- V-224992 Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-224993 PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
Windows Server 2019 (2 rules)
- V-205646 Windows Server 2019 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-205647 Windows Server 2019 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
Windows Server 2022 (2 rules)
- V-254413 Windows Server 2022 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-254414 Windows Server 2022 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657