PT-2023-32598 · Apryse · Apryse Itext

Alkaidlx + 1 · Published 2023-11-26 · Updated 2024-08-02 · CVE-2023-6298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apryse iText version 8.0.2

Description A vulnerability was found in the function main of the file PdfDocument.java, which affects the improper validation of array index. The attack can be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified issues might not apply to the software.

Recommendations For Apryse iText version 8.0.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2023-6298

Affected Products

Apryse Itext

References · 13

• 🔥 https://drive.google.com/drive/folders/1OBAeGH_rNfa1os6g6QlIt4pL-2NKHZm_?usp=sharing · Exploit
• https://ubuntu.com/security/CVE-2023-6298 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6298 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-6298 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6298 · Vendor Advisory
• https://vuldb.com/?id.246124 · Note
• https://vuldb.com/?ctiid.246124 · Note
• https://kb.itextpdf.com/itext/statement-regarding-cve-2022-24198-and-2023-6298 · Note
• https://t.me/cvenotify/62499 · Telegram Post
• https://t.me/cvenotify/69617 · Telegram Post
• https://t.me/cvenotify/88489 · Telegram Post
• https://t.me/cvenotify/62522 · Telegram Post