CVE-2009-3068: adobe robohelp_server

Vulnerability summary

CVE-2009-3068 is a high (CVSS 9.3) vulnerability in adobe robohelp_server. EPSS estimates a 78.18% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 04-09-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action, then accessing it via a direct request to the file in the robohelp/robo/reserved/web directory under its sessionid subdirectory, as demonstrated by the vd_adobe module in VulnDisco Pack Professional 8.7 through 8.11.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.