Adobe Connect <= 12.8 Multiple Vulnerabilities (APSB25-36)

critical Nessus Plugin ID 235875

Synopsis

The remote web server contains an application that is affected by multiple vulnerabilities.

Description

The version of Adobe Connect installed on the remote host is prior to 12.9. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb25-36 advisory.

- Adobe Connect versions 12.8 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.
Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. (CVE-2025-43567)

- Adobe Connect versions 12.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. (CVE-2025-30314, CVE-2025-30315)

- Adobe Connect versions 12.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields.
Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. (CVE-2025-30316)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Connect version 12.9 or later.

Plugin Details

Severity: Critical

ID: 235875

File Name: adobe_connect_apsb25-36.nasl

Version: 1.1

Type: remote

Agent: windows, macosx, unix

Family: CGI abuses

Published: 5/13/2025

Updated: 5/13/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.1

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-43567

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:connect

Required KB Items: installed_sw/Adobe Connect

Exploit Ease: No known exploits are available

Patch Publication Date: 5/13/2025

Vulnerability Publication Date: 5/13/2025

Reference Information

CVE: CVE-2025-30314, CVE-2025-30315, CVE-2025-30316, CVE-2025-43567

CWE: 79

Detections

Analytics