CVE-2021-39855: Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via src Parameter
Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adobe Acrobat Reader DC ActiveX Controlto a version that resolves this vulnerability.Fixed in 2021.005.20060 - Upgrade
Upgrade
Adobe Acrobat Reader DC ActiveX Controlto a version that resolves this vulnerability.Fixed in 2020.004.30006 - Upgrade
Upgrade
Adobe Acrobat Reader DC ActiveX Controlto a version that resolves this vulnerability.Fixed in 2017.011.30199 - Operational
Because exploitation can lead to disclosure of NTLMv2 credentials, rotate any potentially exposed credentials after remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39855?
CVE-2021-39855 is rated as important due to its potential for information disclosure.
How do I fix CVE-2021-39855?
To mitigate CVE-2021-39855, users should update Adobe Acrobat and Acrobat Reader to the latest versions released by Adobe.
What types of software are affected by CVE-2021-39855?
CVE-2021-39855 affects several versions of Adobe Acrobat Reader DC and Adobe Acrobat, specifically the versions mentioned in the details.
Can CVE-2021-39855 affect NTLMv2 credentials?
Yes, CVE-2021-39855 allows an unauthenticated attacker to potentially obtain NTLMv2 credentials.
Is my version of Adobe Acrobat DC vulnerable to CVE-2021-39855?
Versions of Adobe Acrobat DC prior to 21.005.20061 are vulnerable to CVE-2021-39855.