CVE-2024-54037
Published: 10 December 2024
Summary
CVE-2024-54037 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Connect. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 10.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Connect versions 12.6, 11.4.7 and earlier contain a DOM-based cross-site scripting vulnerability (CWE-79) that permits an attacker to inject and execute arbitrary scripts in a victim's browser session. The flaw arises when a DOM element is manipulated through a crafted URL or supplied user input, allowing malicious code to run upon page rendering. The issue carries a CVSS 3.1 score of 8.1 with network attack vector, low complexity, high privileges required, and required user interaction.
A high-privileged attacker can exploit the flaw by supplying a malicious link or compromised form input that the victim must visit or interact with. Successful exploitation results in script execution that can achieve session takeover, producing high impact on confidentiality and integrity while availability remains unaffected.
Adobe's security bulletin APSB24-99, published at https://helpx.adobe.com/security/products/connect/apsb24-99.html, addresses the vulnerability and provides remediation guidance for affected Connect installations.
EPSS for the CVE rose from lower values to a peak of 0.0853 on 2025-12-11 before receding to the current 0.0438, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52250
Vulnerability details
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element…
more
through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.