PT-2009-1966 · Visagesoft · Visagesoft Expert Pdf Editorx

Marco Torti · Publicado 2009-03-20 · Atualizado 2017-09-29 · CVE-2008-6496

Positive Technologies (AI Summary)

CVSS v2.0

8.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions VISAGESOFT eXPert PDF EditorX version 1.0.200.0

Description The issue concerns an insecure method in the VSPDFEditorX.VSPDFEdit ActiveX control, which allows remote attackers to create or overwrite arbitrary files. This is achieved by exploiting the extractPagesToFile method, specifically through its first argument.

Recommendations For version 1.0.200.0, consider disabling the extractPagesToFile method as a temporary workaround until a patch is available. Restrict access to the VSPDFEditorX.VSPDFEdit ActiveX control to minimize the risk of exploitation. Avoid using the first argument in the extractPagesToFile method in the affected ActiveX control until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-6496

Produtos afetados

Visagesoft Expert Pdf Editorx

Referências · 5

• 🔥 https://exploit-db.com/exploits/7358 · Exploit
• 🔥 http://securityfocus.com/bid/32664 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47166 · Nota
• http://secunia.com/advisories/32990 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6496 · Nota de Segurança