PT-2017-18099 · Foxit · Foxit Pdf

Publicado 2017-05-05 · Atualizado 2017-05-17 · CVE-2017-8059

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF - PDF reader, editor, form, signature versions prior to 5.4

Description The issue allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information, including username and password, as well as the static authentication token if the user is already logged in, due to the acceptance of invalid or self-signed TLS certificates.

Recommendations For versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of TLS certificates until a patch is available. Restrict access to sensitive information when using the affected application to minimize the risk of exploitation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-8059

Produtos afetados

Foxit Pdf

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-8059 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8059 · Nota de Segurança
• https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f · Nota