Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing…
Priority LOW 34Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.
Why it matters now
EPSS 0.0122 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:captivate:*:*:*:*:*:*:*:* | all versions | Vulnerable | Adobe |
| cpe:2.3:a:adobe:contribute:2:*:*:*:*:*:*:* | 2 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:contribute:3:*:*:*:*:*:*:* | 3 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:director:*:*:*:*:*:*:*:* | all versions | Vulnerable | Adobe |
| cpe:2.3:a:adobe:dreamweaver:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:elicensing:*:*:*:*:*:*:*:* | all versions | Vulnerable | Adobe |
| cpe:2.3:a:adobe:fireworks:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | all versions | Vulnerable | Adobe |
| cpe:2.3:a:adobe:flash_player:*:*:pro:*:*:*:*:* | all versions | Vulnerable | Adobe |
| cpe:2.3:a:adobe:freehand:mx:*:*:*:*:*:*:* | mx | Vulnerable | Adobe |
- cpe:2.3:a:adobe:captivate:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Adobe
- cpe:2.3:a:adobe:contribute:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Adobe
- cpe:2.3:a:adobe:contribute:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Adobe
- cpe:2.3:a:adobe:director:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Adobe
- cpe:2.3:a:adobe:dreamweaver:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Adobe
- cpe:2.3:a:adobe:elicensing:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Adobe
- cpe:2.3:a:adobe:fireworks:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Adobe
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Adobe
- cpe:2.3:a:adobe:flash_player:*:*:pro:*:*:*:*:* Versions all versions Vulnerable ·Adobe
- cpe:2.3:a:adobe:freehand:mx:*:*:*:*:*:*:* Versions mx Vulnerable ·Adobe
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-4708
- 2026-10-03 Alias added: GHSA-54pm-xxpg-8wgg
References
More Adobe Captivate vulnerabilities
- TI-2017-02318 Improper input validation in Adobe Captivate 9 and earlier. CVSS 3.0CRITICAL 9.8
- TI-2010-03050 Untrusted search path vulnerability in Adobe Captivate 5.0.0.596, and possibly other… CVSS 2.0HIGH 9.3
- TI-2017-02307 Information disclosure in Adobe Captivate 9 and earlier. CVSS 3.0HIGH 7.5
- TI-2021-04117 Uncontrolled Search Path Element in Adobe Captivate 2019 CVSS 3.1HIGH 7.0
- TI-2021-14452 Exposure of resource to wrong sphere in Adobe Captivate CVSS 3.1HIGH 7.3
Sources
- CVE-2005-4708 · CVE Program
- CVE-2005-4708 · NVD
- FIRST EPSS
- GHSA-54pm-xxpg-8wgg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences