CVE-2024-49535: Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Description
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. This vulnerability allows an attacker to provide malicious XML input containing a reference to an external entity, leading to data disclosure or potentially code execution. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document.
Classification
CVE ID: CVE-2024-49535
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.3
Affected Products
Vendor: Adobe
Product: Acrobat Reader
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.07% (probability of being exploited)
EPSS Percentile: 31.78% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)