PT-2023-32598 · Apryse · Apryse Itext

Alkaidlx + 1 · Publicado 2023-11-26 · Atualizado 2024-08-02 · CVE-2023-6298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apryse iText version 8.0.2

Description A vulnerability was found in the function main of the file PdfDocument.java, which affects the improper validation of array index. The attack can be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified issues might not apply to the software.

Recommendations For Apryse iText version 8.0.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

CVE-2023-6298

Produtos afetados

Apryse Itext

Referências · 13

• 🔥 https://drive.google.com/drive/folders/1OBAeGH_rNfa1os6g6QlIt4pL-2NKHZm_?usp=sharing · Exploit
• https://vuldb.com/?id.246124 · Nota
• https://ubuntu.com/security/CVE-2023-6298 · Aviso do Fabricante
• https://vuldb.com/?ctiid.246124 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6298 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-6298 · Nota de Segurança
• https://kb.itextpdf.com/itext/statement-regarding-cve-2022-24198-and-2023-6298 · Nota
• https://t.me/cvenotify/62499 · Publicação no Telegram
• https://t.me/cvenotify/69617 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-6298 · Nota de Segurança
• https://t.me/cvenotify/88489 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-6298 · Aviso do Fabricante
• https://t.me/cvenotify/62522 · Publicação no Telegram