PT-2021-14783 · Nitro · Nitro Pro Pdf

Published 2021-09-15 · Updated 2022-10-25 · CVE-2021-21798

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nitro Pro PDF (affected versions not specified)

Description An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-562

Related Identifiers

CVE-2021-21798

Affected Products

Nitro Pro Pdf

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1267 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21798 · Security Note
• https://t.me/cibsecurity/28905 · Telegram Post
• https://t.me/cvenotify/21545 · Telegram Post
• https://t.me/cvenotify/20897 · Telegram Post