{"id":"CVE-2024-12786","state":"PUBLISHED","title":"X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management","description":"A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe.","publishedAt":"2024-12-19T15:00:22.547Z","updatedAt":"2024-12-20T20:18:23.612Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["X1a0He Adobe Downloader"],"affected":[{"vendor":"X1a0He","product":"Adobe Downloader","versions":[{"version":"1.3.0","status":"affected"},{"version":"1.3.1","status":"affected"}],"modules":["XPC Service"]}],"references":["https://vuldb.com/?id.288966","https://vuldb.com/?ctiid.288966","https://vuldb.com/?submit.464685","https://winslow1984.com/books/cve-collection/page/adobe-downloader-131-local-privilege-escalation"],"weaknesses":["CWE-269","CWE-266"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12786.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-12786","state":"PUBLISHED","datePublished":"2024-12-19T15:00:22.547Z","dateUpdated":"2024-12-20T20:18:23.612Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-12-19T08:20:09.032Z"},"containers":{"cna":{"title":"X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe."},{"lang":"de","value":"Es wurde eine Schwachstelle in X1a0He Adobe Downloader bis 1.3.1 für macOS gefunden. Sie wurde als kritisch eingestuft. Hiervon betroffen ist die Funktion shouldAcceptNewConnection der Datei com.x1a0he.macOS.Adobe-Downloader.helper der Komponente XPC Service. Durch das Manipulieren mit unbekannten Daten kann eine improper privilege management-Schwachstelle ausgenutzt werden. Der Angriff hat dabei lokal zu erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"X1a0He","product":"Adobe Downloader","versions":[{"version":"1.3.0","status":"affected"},{"version":"1.3.1","status":"affected"}],"modules":["XPC Service"]}],"references":[{"url":"https://vuldb.com/?id.288966","name":"VDB-288966 | X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.288966","name":"VDB-288966 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.464685","name":"Submit #464685 | https://github.com/X1a0He Adobe-Downloader <= 1.3.1 Local Privilege Escalation","tags":["third-party-advisory"]},{"url":"https://winslow1984.com/books/cve-collection/page/adobe-downloader-131-local-privilege-escalation","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.5,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.8,"vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":6.8,"vectorString":"AV:L/AC:L/Au:S/C:C/I:C/A:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","type":"CWE","lang":"en","description":"Improper Privilege Management"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-12-19T15:00:22.547Z"},"timeline":[{"time":"2024-12-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-12-19T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-12-19T09:26:20.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"winslow1984 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-20T20:18:03.302209Z","id":"CVE-2024-12786","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-20T20:18:23.612Z"}}]}}}