Vulnerabilities > CVE-2021-40720 - Deserialization of Untrusted Data vulnerability in Adobe Ops-Cli

CVSS 10.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

low complexity

adobe

CWE-502

critical

NVD

Published: 2021-10-15

Updated: 2021-10-20

Summary

Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.

Vulnerable Configurations

Part	Description	Count
Application	Adobe Adobe OPS CLI - Adobe OPS CLI 0.20 Adobe OPS CLI 0.21 Adobe OPS CLI 0.22 Adobe OPS CLI 0.23 Adobe OPS CLI 0.24 Adobe OPS CLI 0.25 Adobe OPS CLI 0.26 Adobe OPS CLI 0.27 Adobe OPS CLI 0.28 Adobe OPS CLI 0.29 Adobe OPS CLI 0.30 Adobe OPS CLI 0.31 Adobe OPS CLI 0.32 Adobe OPS CLI 0.33 Adobe OPS CLI 0.34 Adobe OPS CLI 0.35 Adobe OPS CLI 0.36 Adobe OPS CLI 1.0 Adobe OPS CLI 1.1 Adobe OPS CLI 1.2 Adobe OPS CLI 1.3 Adobe OPS CLI 1.4 Adobe OPS CLI 1.5 Adobe OPS CLI 1.6 Adobe OPS CLI 1.7 Adobe OPS CLI 1.8 Adobe OPS CLI 1.9 Adobe OPS CLI 1.10.0 Adobe OPS CLI 1.10.1 Adobe OPS CLI 1.11.0 Adobe OPS CLI 1.11.1 Adobe OPS CLI 1.11.2 Adobe OPS CLI 1.11.3 Adobe OPS CLI 1.11.4 Adobe OPS CLI 1.11.5 Adobe OPS CLI 1.11.6 Adobe OPS CLI 1.11.7 Adobe OPS CLI 1.11.8 Adobe OPS CLI 1.11.9 Adobe OPS CLI 1.11.10 Adobe OPS CLI 1.11.11 Adobe OPS CLI 1.11.12 Adobe OPS CLI 1.12.0 Adobe OPS CLI 1.12.1 Adobe OPS CLI 1.12.2 Adobe OPS CLI 2.0.3 Adobe OPS CLI 2.0.4	48

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

References

https://helpx.adobe.com/security/products/ops_cli/apsb21-88.html