CRITICAL🇵🇱 Wersja polska

CVE-2021-38572

CVSS 9.8v3.1pub. 2021-08-11upd. 2024-11-21

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Foxitsoftware Foxit Reader

    APP
    Foxitsoftware
    < 10.1.4

  • Foxitsoftware Phantompdf

    APP
    Foxitsoftware
    < 10.1.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-38568CRITICAL9.8PL ✓same product

Uszkodzenie pamięci podczas konwersji PDF w Foxit Reader i PhantomPDF

CVE-2021-38570CRITICAL9.1PL ✓same product

Foxit Reader/PhantomPDF: usuwanie plików przez atak symlink

CVE-2021-33793CRITICAL9.8PL ✓same product

Zapis poza granicami bufora w Foxit Reader i PhantomPDF przy konwersji dokumentów Office

CVE-2021-33794CRITICAL9.1PL ✓same product

Foxit Reader i PhantomPDF — ujawnienie danych lub crash przy obsłudze XFA

CVE-2021-38573CRITICAL9.8PL ✓same product

Foxit Reader/PhantomPDF: zapis do dowolnych plików przez CombineFiles