CVE-2021-28571: Adobe After Effects improper neutralization of special elements could lead to remote code execution
Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-28571?
CVE-2021-28571 is a command injection vulnerability in Adobe After Effects version 18.1 and earlier.
How does CVE-2021-28571 affect Adobe After Effects?
CVE-2021-28571 allows an attacker to execute arbitrary code in the context of the application.
What is the severity of CVE-2021-28571?
CVE-2021-28571 has a severity rating of 8.8, which is considered high.
How can an attacker exploit CVE-2021-28571?
An attacker can exploit CVE-2021-28571 by chaining it with a development and debugging tool for JavaScript scripts.
Is Microsoft Windows affected by CVE-2021-28571?
No, Microsoft Windows is not vulnerable to CVE-2021-28571.