PT-2017-17739 · Nitro · Nitro Pro

Mr_Me · Publicado 2017-08-03 · Atualizado 2020-08-04 · CVE-2017-7442

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nitro Pro version 11.0.3.173

Description The issue allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.

Recommendations For Nitro Pro version 11.0.3.173, consider disabling the saveAs and launchURL functions until a patch is available to prevent potential exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-7442

Produtos afetados

Nitro Pro

Referências · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb · Exploit
• 🔥 https://exploit-db.com/exploits/42418 · Exploit
• 🔥 http://srcincite.io/advisories/src-2017-0005 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7442 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7442 · Aviso do Fabricante