PT-2019-12664 · Realobjects · Pdfreactor

Sean Melia · Publicado 2019-06-11 · Atualizado 2019-06-13 · CVE-2019-12154

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions RealObjects PDFreactor versions prior to 10.1.10722

Description The issue allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions. This is due to an XXE (XML External Entity) issue in the XML parser library.

Recommendations For versions prior to 10.1.10722, update to version 10.1.10722 or later to resolve the issue. As a temporary workaround, consider restricting the use of externally referenced resources in the XML parser library until a patch is applied.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-12154

Produtos afetados

Pdfreactor

Referências · 5

• https://pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available · Aviso do Fabricante
• https://pdfreactor.com/important-pdfreactor-security-advisory · Aviso do Fabricante
• https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12154 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12154 · Aviso do Fabricante