PT-2017-18099 · Foxit · Foxit Pdf

Published 2017-05-05 · Updated 2017-05-17 · CVE-2017-8059

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF - PDF reader, editor, form, signature versions prior to 5.4

Description The issue allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information, including username and password, as well as the static authentication token if the user is already logged in, due to the acceptance of invalid or self-signed TLS certificates.

Recommendations For versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of TLS certificates until a patch is available. Restrict access to sensitive information when using the affected application to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-8059

Affected Products

Foxit Pdf

References · 3

• https://osv.dev/vulnerability/CVE-2017-8059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8059 · Security Note
• https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f · Note