CVE-2021-39855: Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via src Parameter
First published: Tue Sep 14 2021(Updated: )
Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30199 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.011.30199 | |
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30006 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.004.30006 | |
| Adobe Acrobat | >=15.008.20082<=21.005.20058 | |
| Adobe Acrobat Reader | >=15.008.20082<=21.005.20058 | |
| Adobe Acrobat | >=15.008.20082<=21.005.20060 | |
| Adobe Acrobat Reader | >=15.008.20082<=21.005.20060 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-39855?
CVE-2021-39855 is rated as important due to its potential for information disclosure.
How do I fix CVE-2021-39855?
To mitigate CVE-2021-39855, users should update Adobe Acrobat and Acrobat Reader to the latest versions released by Adobe.
What types of software are affected by CVE-2021-39855?
CVE-2021-39855 affects several versions of Adobe Acrobat Reader DC and Adobe Acrobat, specifically the versions mentioned in the details.
Can CVE-2021-39855 affect NTLMv2 credentials?
Yes, CVE-2021-39855 allows an unauthenticated attacker to potentially obtain NTLMv2 credentials.
Is my version of Adobe Acrobat DC vulnerable to CVE-2021-39855?
Versions of Adobe Acrobat DC prior to 21.005.20061 are vulnerable to CVE-2021-39855.
- agent/type
- agent/author
- agent/references
- agent/description
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/17.011.30059
- version/adobe acrobat reader/17.011.30199
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.004.30006
- canonical/adobe acrobat
- version/adobe acrobat/15.008.20082
- version/adobe acrobat/21.005.20058
- version/adobe acrobat reader/15.008.20082
- version/adobe acrobat reader/21.005.20058
- version/adobe acrobat/21.005.20060
- version/adobe acrobat reader/21.005.20060