PT-2021-17490 · Foxit · Foxit Pdf Sdk For Web

Published 2021-07-20 · Updated 2021-07-29 · CVE-2021-27517

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Foxit PDF SDK For Web versions prior to 7.5.1 is not specified, however, Foxit PDF SDK For Web through 7.5.0 is mentioned as vulnerable. Foxit PDF SDK For Web versions through 7.5.0

Description The issue allows for arbitrary JavaScript code execution in the browser. This occurs when a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert in the Acrobat JavaScript API.

Recommendations For Foxit PDF SDK For Web versions through 7.5.0, update to a version later than 7.5.0 to resolve the issue. As a temporary workaround, consider restricting the upload of PDF documents or disabling the use of app.alert until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27517

Affected Products

Foxit Pdf Sdk For Web

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-27517 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27517 · Vendor Advisory
• https://foxitsoftware.com/support/security-bulletins.html · Vendor Advisory
• https://t.me/cvenotify/18285 · Telegram Post