PT-2019-9811 · Foxit · Foxit Reader Sdk (Activex) Professional

Publicado 2019-06-17 · Atualizado 2019-06-18 · CVE-2018-19445

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK (ActiveX) Professional version 5.4.0.1031

Description A command injection issue can occur when processing specially crafted PDF files, allowing an attacker to potentially gain remote code execution. This issue is related to the use of the JavaScript API app.launchURL.

Recommendations For Foxit Reader SDK (ActiveX) Professional version 5.4.0.1031, consider disabling the app.launchURL JavaScript API until a patch is available to prevent potential exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2018-19445

Produtos afetados

Foxit Reader Sdk (Activex) Professional

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-19445 · Nota de Segurança
• https://foxitsoftware.com/support/security-bulletins.php · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-19445 · Aviso do Fabricante