PT-2019-12664 · Realobjects · Pdfreactor

Sean Melia · Published 2019-06-11 · Updated 2019-06-13 · CVE-2019-12154

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions RealObjects PDFreactor versions prior to 10.1.10722

Description The issue allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions. This is due to an XXE (XML External Entity) issue in the XML parser library.

Recommendations For versions prior to 10.1.10722, update to version 10.1.10722 or later to resolve the issue. As a temporary workaround, consider restricting the use of externally referenced resources in the XML parser library until a patch is applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-12154

Affected Products

Pdfreactor

References · 5

• https://pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available · Vendor Advisory
• https://pdfreactor.com/important-pdfreactor-security-advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12154 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12154 · Vendor Advisory
• https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html · Note