Vulnerability CVE-2019-12153


Published: 2019-06-11

Description:
Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content.

Type:

CWE-918

Vendor: Realobjects
Product: Pdfreactor 
Version:
10.0.10722.3
10.0.10722.2
10.0.10722.1
10.0.10722
10.0.10702

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None

 References:
https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html
https://www.pdfreactor.com/important-pdfreactor-security-advisory/
https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/

Copyright 2019, cxsecurity.com

 

Back to Top