PT-2018-13218 · Accusoft · Accusoft Prizmdoc Html5 Document Viewer

Published 2018-12-10 · Updated 2019-01-03 · CVE-2018-15805

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Accusoft PrizmDoc HTML5 Document Viewer versions prior to 13.5

Description The issue allows an attacker to read arbitrary files or cause a denial of service due to an XML external entity (XXE) vulnerability.

Recommendations For versions prior to 13.5, update to version 13.5 or later to resolve the issue.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-15805

Affected Products

Accusoft Prizmdoc Html5 Document Viewer

References · 5

• 🔥 https://medium.com/@mrnikhilsri/oob-xxe-in-prizmdoc-cve-2018-15805-dfb1e474345c · Exploit
• https://osv.dev/vulnerability/CVE-2018-15805 · Vendor Advisory
• https://help.accusoft.com/PrizmDoc/v13.5/HTML/webframe.html#Release_v13_5.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15805 · Security Note
• https://medium.com/%40mrnikhilsri/oob-xxe-in-prizmdoc-cve-2018-15805-dfb1e474345c · Note