Friday, December 6, 2024

How To Fix the ACE Vulnerability In Adobe After Effects CVE-2022-23200

CVE-2022-23200

How To Fix the ACE Vulnerability In Adobe After Effects:Adobe uncovered a new arbitrary code execution vulnerability (ACE) in Adobe After Effects. The flaw, which is tracked as CVE-2022-23200, has a base score of 7.8 out of 10.0 in the CVSS scoring system. The successful exploitation of this vulnerability may lead to arbitrary code execution in the context of the current user.

How To Fix the ACE Vulnerability In Adobe After Effects

Since it is a high severity vulnerability with code execution permissions, it is good to fix the flaw before join the list of victims. Let’s see how to Fix the new ACE vulnerability in Adobe After Effects (AE).

What Is Adobe After Effects?

After Effects (AE) is a popular photo and video editing program developed by Adobe. It gains high tractions because of its professional toolset. Its toolset allows editors to complete any kind of creative editing work from basic editing to character animation, object removal from video clips, 3D designs, and more. It is a subscription-based product. You will have to pay to enroll in its subscription. You can visit this link to download or know more about the product.

Summary Of The CVE-2022-23200 Vulnerability:

The flaw lice in improper parsing of 3GP files. Adobe said, affected versions of After Effects failed to properly validate user-supplied data, which can result in a write past the end of an allocated structure. This allows remote attackers to execute code in the context of the current process.

Recommended:  McAfee Agent bug lets hackers run code with Windows SYSTEM privilege

Researchers say that the flaw can’t be exploited without user interaction. Threat actors should trick the victim to visit a malicious page or open a malicious file to exploit the CVE-2022-23200 vulnerability.

Associated CVE IDCVE-2022-23200
DescriptionArbitrary code execution vulnerability in Adobe After Effects
Associated ZDI IDZDI-CAN-15254
CVSS Score7.8 Medium
VectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Impact Score
Exploitability Score
Attack Vector (AV)Local
Attack Complexity (AC)Low
Privilege Required (PR)None
User Interaction (UI)Required
ScopeUnchanged
Confidentiality (C)High
Integrity (I)High
availability (a)High

After Effects Affected By The CVE-2022-23200 Vulnerability:

The vendor says that AE v22.1.1 and v18.4.3 and earlier are vulnerable to the CVE-2022-23200 Vulnerability. Users of Windows and Mac are urged to take action at the earliest.

ProductVersionPlatform
Adobe After Effects22.1.1 and earlier versions     Windows and macOS
Adobe After Effects18.4.3 and earlier versions     Windows and macOS

How To Fix the ACE Vulnerability In Adobe After Effects CVE-2022-23200?

Adobe has responded to the vulnerability by releasing patches to fix it. Adobe recommends users update their After Effects to the latest available version. Here you can see the patched version details in the table.

ProductVersionPlatformPriority RatingAvailability
Adobe After Effects22.2Windows and macOS3Download Center
Adobe After Effects18.4.4Windows and macOS3Download Center

How to Update the Adobe After Effects?



Although you can download and apply the updates, Adobe recommends using the Creative Cloud desktop app. The app supports updating multiple Adobe products to the latest versions.

You can also use the Creative Cloud desktop app to enable auto-update, control auto-updates for individual apps, manual update of all or selected products.

  1. Download and Install Creative Cloud desktop appDownload the Creative Cloud App from here. Then install the app using your registered Adobe account or email ID.
  2. Select Preferences

    Open the Creative Cloud desktop app. Click on the Account icon in the upper right, then select Preferences.
    . Select Preferences in Creative Cloud Desktop App
  3. Configure the update settings for all or specific appsSelects the Aps tab the do any of the following.


    All apps  To set automatic updates for all apps, turn on Auto-update.
    Specific apps  To choose the auto-update setting for specific apps, turn on Auto-update, then set the toggle as needed for each individual app.

    Visit this page for more information.
Recommended:  CISA Adds Another 95 Flaws to its Actively Exploited Vulnerabilities Catalog

We hope this post will help you know How to Fix the ACE Vulnerability in Adobe After Effects- CVE-2022-23200. 

You may also enjoy reading, CVEs You May Have Missed While Log4J Stole The Headlines

Got to Cybersecurity News

Go to Homepage

Go to Cybersecurity Academy

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose
Share the word, let's increase Cybersecurity Awareness as we know it
- Sponsored -

Sponsored Offer

Unleash the Power of the Cloud: Grab $200 Credit for 60 Days on DigitalOcean!

Digital ocean free 200

Discover more infosec

Steven Black (n0tst3)
Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK. I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated... I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK. I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

more infosec reads

Subscribe for weekly updates

explore

more

security