An incorrect authorization vulnerability in Adobe Connect allows attackers to achieve arbitrary code execution through malicious script injection, requiring victim interaction.

This is an incorrect authorization vulnerability that allows for arbitrary code execution in the context of the user. An attacker can inject malicious scripts into a web page, which triggers upon user interaction, such as visiting a crafted URL.

The CVSS score of 9.3 signifies a critical risk, as the vulnerability allows for code execution that could compromise user accounts and sessions. The business impact includes the potential for unauthorized access to sensitive meeting data, lateral movement within the organization, and the loss of confidentiality for internal communications, given the platform's role in enterprise collaboration.

Immediate Action: Upgrade to the latest version of Adobe Connect immediately to resolve the authorization flaw.

Proactive Monitoring: Review web server logs for suspicious URL patterns and monitor for unexpected client-side script execution within the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection attempts and validate input parameters.

Public Exploit Available: Unknown

Although exploitation requires user interaction, the potential for arbitrary code execution makes this a critical security concern. Organizations using Adobe Connect must ensure that all instances are updated to the latest available version to mitigate the risk of script injection and unauthorized session access.