PT-2019-15735 · Nitro · Nitro Pro

Publicado 2019-11-21 · Atualizado 2021-07-21 · CVE-2019-18958

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nitro Pro versions prior to 13.2

Description The issue arises when Nitro Pro creates a debug.log file in the same directory as a .pdf file, specifically if the .pdf document was generated through an OCR operation on the JPEG output of a scanner. This can pose a security risk if the debug.log file is later edited and then executed.

Recommendations For versions prior to 13.2, consider removing or restricting access to the debug.log file created by Nitro Pro to minimize potential risks. As a temporary workaround, avoid executing any debug.log files that may have been edited.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2019-18958

Produtos afetados

Nitro Pro

Referências · 3

• 🔥 https://a-man-in-the-cookie.blogspot.com/2019/11/nitro-pro-vulnerability.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18958 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18958 · Aviso do Fabricante