The library feature for Adobe Content Server 3.0 allows a remote attacker to check out an eBook even when the maximum number of loans is exceeded by accessing the "Add to bookbag" feature when the server reports that no more copies are available.
Product
adobe content server vulnerabilities
3 published CVES affecting adobe content server, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 3
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest adobe content server CVEs
Newest publication first
-
MediumCVSS 5.0 EPSS 2.3%
-
MediumCVSS 5.0 EPSS 2.6%
The library feature for Adobe Content Server 3.0 allows a remote attacker to check out an eBook for an arbitrary length of time via a modified loanMin parameter to download.asp.
-
MediumCVSS 5.0 EPSS 2.5%
The library feature for Adobe Content Server 3.0 does not verify if a customer has already checked out an eBook, which allows remote attackers to cause a denial of service (resource exhaustion) by checking out the same book multiple times.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.