PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability.
The specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://www.zerodayinitiative.com/advisories/ZDI-24-198/ |
History
Tue, 03 Dec 2024 22:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Pdf-xchange pdf-tools
|
|
CPEs | cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:* cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:* |
|
Vendors & Products |
Pdf-xchange pdf-tools
|
Tue, 03 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Pdf-xchange
Pdf-xchange pdf-xchange Editor |
|
CPEs | cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:* | |
Vendors & Products |
Pdf-xchange
Pdf-xchange pdf-xchange Editor |
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published: 2024-04-01T21:48:49.889Z
Updated: 2024-08-02T00:34:51.004Z
Reserved: 2024-02-23T19:42:40.846Z
Link: CVE-2024-27323
Vulnrichment
Updated: 2024-08-02T00:34:51.004Z
NVD
Status : Analyzed
Published: 2024-04-01T22:15:15.950
Modified: 2024-12-03T22:03:36.550
Link: CVE-2024-27323
Redhat
No data.