CVE-2020-10909

🗓️ 22 Apr 2020 20:51:04Reported by zdiType

Remote code execution vulnerability in Foxit PhantomPDF 9.7.0.29478 via AddWatermark command allows execution of arbitrary code. Requires user interaction to visit a malicious page or open a malicious file

Reporter	Title	Published	Views	Family All 8
CNVD	Foxit Reader and PhantomPDF Type Obfuscation Remote Code Execution Vulnerability (CNVD-2020-244444)	17 Apr 202000:00	–	cnvd
Cvelist	CVE-2020-10909	22 Apr 202020:51	–	cvelist
EUVD	EUVD-2020-3315	7 Oct 202500:30	–	euvd
NVD	CVE-2020-10909	22 Apr 202021:15	–	nvd
OSV	CVE-2020-10909	22 Apr 202021:15	–	osv
Prion	Type confusion	22 Apr 202021:15	–	prion
RedhatCVE	CVE-2020-10909	5 Feb 202515:19	–	redhatcve
Zero Day Initiative	Foxit PhantomPDF AddWatermark Type Confusion Remote Code Execution Vulnerability	16 Apr 202000:00	–	zdi

NVD

Vulners

Node

foxitsoftware phantompdfRange≤9.7.1.29511

foxitsoftware readerRange≤9.7.1.29511

AND

microsoft windowsMatch-

[
  {
    "product": "PhantomPDF",
    "vendor": "Foxit",
    "versions": [
      {
        "status": "affected",
        "version": "9.7.0.29478"
      }
    ]
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-20-516/
foxitsoftware	www.foxitsoftware.com/support/security-bulletins.php

21 Nov 2024 04:56Current

7.9High risk

Vulners AI Score7.9

CVSS 26.8

CVSS 3.17.8

CVSS 37.8

EPSS0.00374

CWE-843