CVE-2021-28571: Adobe After Effects improper neutralization of special elements could lead to remote code execution
First published: Wed Sep 08 2021(Updated: )
Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe After Effects | <=18.1 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2021-28571?
CVE-2021-28571 is a command injection vulnerability in Adobe After Effects version 18.1 and earlier.
How does CVE-2021-28571 affect Adobe After Effects?
CVE-2021-28571 allows an attacker to execute arbitrary code in the context of the application.
What is the severity of CVE-2021-28571?
CVE-2021-28571 has a severity rating of 8.8, which is considered high.
How can an attacker exploit CVE-2021-28571?
An attacker can exploit CVE-2021-28571 by chaining it with a development and debugging tool for JavaScript scripts.
Is Microsoft Windows affected by CVE-2021-28571?
No, Microsoft Windows is not vulnerable to CVE-2021-28571.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/adobe
- canonical/adobe after effects
- version/adobe after effects/18.1
- vendor/microsoft
- canonical/microsoft windows