8.8
CVE-2024-4367
- EPSS 72.65%
- Veröffentlicht 14.05.2024 18:15:12
- Zuletzt bearbeitet 12.05.2026 12:17:19
- Erkennungen
LoginPDF.js < 4.2.67 - Arbitrary JavaScript Execution
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Mögliche Gegenmaßnahme
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Update to version 1.15.6, or a newer patched version
ARI Fancy Lightbox – Popup for WordPress: Update to version 1.3.15, or a newer patched version
BSK PDF Manager: Update to version 3.6.1, or a newer patched version
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents: Update to version 4.0.3, or a newer patched version
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress: Update to version 4.8.0, or a newer patched version
PDF Poster – Let visitors read PDF's without leaving the page: Update to version 2.1.22, or a newer patched version
PDF Viewer for Elementor: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
PDF viewer for Elementor & Gutenberg: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
PDF.js Viewer: Update to version 2.2, or a newer patched version
Tainacan: Update to version 0.21.6, or a newer patched version
Wonder PDF Embed: Update to version 2.8, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Thunderbird Version < 115.11.0
Debian ≫ Debian Linux Version 10.0
Open-xchange ≫ Open-xchange Appsuite Frontend Version < 7.10.6
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update -
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision10
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision11
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision12
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision13
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision14
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision15
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision16
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision17
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision18
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision19
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision20
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision21
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision22
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision23
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision24
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision25
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision26
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision27
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision28
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision29
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision3
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision30
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision31
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision32
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision33
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision34
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision35
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision36
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision37
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision38
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision39
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision4
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision40
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision41
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision42
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision43
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision44
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision5
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision6
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision7
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision8
Open-xchange ≫ Open-xchange Appsuite Frontend Version 7.10.6 Update revision9
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Version
*-1.15.5
SystemWordPress Plugin
≫
Produkt
ARI Fancy Lightbox – Popup for WordPress
Version
*-1.3.14
SystemWordPress Plugin
≫
Produkt
BSK PDF Manager
Version
*-3.6
SystemWordPress Plugin
≫
Produkt
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Version
*-4.0.2
SystemWordPress Plugin
≫
Produkt
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress
Version
*-4.7.1
SystemWordPress Plugin
≫
Produkt
PDF Poster – Let visitors read PDF's without leaving the page
Version
*-2.1.21
SystemWordPress Plugin
≫
Produkt
PDF Viewer for Elementor
Version
*-2.9.3
SystemWordPress Plugin
≫
Produkt
PDF viewer for Elementor & Gutenberg
Version
*-1.3.2
SystemWordPress Plugin
≫
Produkt
PDF.js Viewer
Version
*-2.1.8.1
SystemWordPress Plugin
≫
Produkt
Tainacan
Version
*-0.21.5
SystemWordPress Plugin
≫
Produkt
Wonder PDF Embed
Version
*-2.7
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 72.65% | 0.994 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| CISA-ADP | 5.6 | 2.2 | 3.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
|
CWE-754 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
https://www.mozilla.org/security/advisories/mfsa2024-21/
https://www.mozilla.org/security/advisories/mfsa2024-22/
https://www.mozilla.org/security/advisories/mfsa2024-23/
http://seclists.org/fulldisclosure/2024/Aug/30
https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/
https://github.com/gogs/gogs/issues/7928
https://github.com/mozilla/pdf.js/releases/tag/v4.2.67
https://www.exploit-db.com/exploits/52273
https://cert-portal.siemens.com/productcert/html/ssa-827383.html
https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce7aa01-7e79-4048-a84d-fcb9541d5f8b