Adobe uncovered a new arbitrary code execution vulnerability (ACE) in Adobe After Effects. The flaw, which is tracked as CVE-2022-23200, has a base score of 7.8 out of 10.0 in the CVSS scoring system. The successful exploitation of this vulnerability may lead to arbitrary code execution in the context of the current user. Since it is a high severity vulnerability with code execution permissions, it is good to fix the flaw before join the list of victims. Let’s see how to Fix the new ACE vulnerability in Adobe After Effects (AE).
Table of Contents
What Is Adobe After Effects?
After Effects (AE) is a popular photo and video editing program developed by Adobe. It gains high tractions because of its professional toolset. Its toolset allows editors to complete any kind of creative editing work from basic editing to character animation, object removal from video clips, 3D designs, and more. It is a subscription-based product. You will have to pay to enroll in its subscription. You can visit this link to download or know more about the product.
Summary Of The CVE-2022-23200 Vulnerability:
The flaw lice in improper parsing of 3GP files. Adobe said, affected versions of After Effects failed to properly validate user-supplied data, which can result in a write past the end of an allocated structure. This allows remote attackers to execute code in the context of the current process.
Researchers say that the flaw can’t be exploited without user interaction. Threat actors should trick the victim to visit a malicious page or open a malicious file to exploit the CVE-2022-23200 vulnerability.
| Associated CVE ID | CVE-2022-23200 |
| Description | Arbitrary code execution vulnerability in Adobe After Effects |
| Associated ZDI ID | ZDI-CAN-15254 |
| CVSS Score | 7.8 Medium |
| Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Impact Score | – |
| Exploitability Score | – |
| Attack Vector (AV) | Local |
| Attack Complexity (AC) | Low |
| Privilege Required (PR) | None |
| User Interaction (UI) | Required |
| Scope | Unchanged |
| Confidentiality (C) | High |
| Integrity (I) | High |
| availability (a) | High |
After Effects Affected By The CVE-2022-23200 Vulnerability:
The vendor says that AE v22.1.1 and v18.4.3 and earlier are vulnerable to the CVE-2022-23200 Vulnerability. Users of Windows and Mac are urged to take action at the earliest.
| Product | Version | Platform |
|---|---|---|
| Adobe After Effects | 22.1.1 and earlier versions | Windows and macOS |
| Adobe After Effects | 18.4.3 and earlier versions | Windows and macOS |
How To Fix The New ACE Vulnerability In Adobe After Effects- CVE-2022-23200?
Adobe has responded to the vulnerability by releasing patches to fix it. Adobe recommends users update their After Effects to the latest available version. Here you can see the patched version details in the table.
| Product | Version | Platform | Priority Rating | Availability |
|---|---|---|---|---|
| Adobe After Effects | 22.2 | Windows and macOS | 3 | Download Center |
| Adobe After Effects | 18.4.4 | Windows and macOS | 3 | Download Center |
How to Update the Adobe After Effects?
Although you can download and apply the updates, Adobe recommends using the Creative Cloud desktop app. The app supports updating multiple Adobe products to the latest versions.
You can also use the Creative Cloud desktop app to enable auto-update, control auto-updates for individual apps, manual update of all or selected products.
- Download and Install Creative Cloud desktop app
Download the Creative Cloud App from here. Then install the app using your registered Adobe account or email ID.
- Select Preferences
Open the Creative Cloud desktop app. Click on the Account icon in the upper right, then select Preferences.
.
- Configure the update settings for all or specific apps
Selects the Aps tab the do any of the following.
All apps To set automatic updates for all apps, turn on Auto-update.
Specific apps To choose the auto-update setting for specific apps, turn on Auto-update, then set the toggle as needed for each individual app.Visit this page for more information.
We hope this post will help you know How to Fix the New ACE Vulnerability in Adobe After Effects- CVE-2022-23200. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.
原创文章，作者：ItWorker，如若转载，请注明出处：https://blog.ytso.com/tech/aiops/270155.html