CVE-2018-19446

EPSS 0.35%
Veröffentlicht 17.06.2019 20:15:09
Zuletzt bearbeitet 21.11.2024 03:57:56
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Foxitsoftware ≫ Foxit Pdf Sdk Activex SwEditionprofessional Version <= 5.5.0

Microsoft ≫ Windows Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.35%	0.571

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://www.foxitsoftware.com/support/security-bulletins.php

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-19446

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-19446

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-19446

EUVD