Pdf Editor CVE-2024-25858

HIGH

Multiple Interpretations of UI Input (CWE-450)

2024-03-05 cve@mitre.org

RCE Pdf Editor Pdf Reader

8.4

CVSS 3.1 · Vendor: mitre

Share

Severity by source

Vendor (mitre) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Mar 05, 2024 - 21:15 cve.org

HIGH 8.4

DescriptionCVE.org

In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to review parameters of commands.

AnalysisAI

In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to review parameters of commands. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-450. In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to review parameters of commands. Affected products include: Foxit Pdf Editor, Foxit Pdf Reader. Version information: before 2024.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Pdf Editor

View all

CVE-2022-28104 CRITICAL Act Now POC

Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability. Rated critical severity (CVSS

CVE-2024-49576 HIGH This Week POC

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. Rated

CVE-2024-47810 HIGH This Week POC

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. Rated high severi

CVE-2024-25938 HIGH This Week POC

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. Rated high severi

CVE-2024-25648 HIGH This Week POC

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. Rated high sever

CVE-2024-25575 HIGH This Week POC

A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. Rated

CVE-2024-29072 HIGH This Week POC

A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. Rated high severity (CVSS 8.2), this vul

CVE-2022-26979 HIGH This Week POC

Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a NULL pointer dereference when this.Span is used for

CVE-2022-27944 HIGH This Week POC

Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow an exportXFAData NULL pointer dereference. Rated high

CVE-2021-38563 CRITICAL Act Now

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. Rated critical severity (CVSS 9.

CVE-2022-27359 MEDIUM This Month POC

Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a this.maildoc NULL pointer dereference. Rated medium

CVE-2021-38564 CRITICAL Act Now

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. Rated critical severity (CVSS 9.

Same weakness CWE-450 – Multiple Interpretations of UI Input

View all

CVE-2022-20863 MEDIUM

CVE-2021-1242 MEDIUM

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

Share

CVE-2024-25858 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy