Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2018-18689
HistoryJan 07, 2021 - 6:15 p.m.

CVE-2018-18689

2021-01-0718:15:12
CWE-347
[email protected]
web.nvd.nist.gov
1

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.0%

JSON

The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.

Affected configurations

NVD
Node
microsoftwindowsMatch-
AND
avanquestexpert_pdf_ultimateMatch12.0.20
OR
avanquestpdf_experte_ultimateMatch9.0.270
OR
foxitsoftwarefoxit_readerMatch9.1.0
OR
foxitsoftwarefoxit_readerMatch9.2.0.9297
OR
foxitsoftwarefoxit_readerMatch9.3.0.10826
OR
gonitronitro_proMatch11.0.3.173
OR
gonitronitro_readerMatch5.5.9.2
OR
iskysoftpdf_editor_6Match6.4.2.3521professional
OR
iskysoftpdfelement6Match6.8.0.3523professional
OR
iskysoftpdfelement6Match6.8.4.3921professional
OR
pdfforgepdf_architectMatch6.0.37
OR
pdfforgepdf_architectMatch6.1.24.1862
OR
qoppapdf_studioMatch12.0.7professional
OR
qoppapdf_studio_viewer_2018Match2018.0.1
OR
qoppapdf_studio_viewer_2018Match2018.2.0
OR
sodapdfsoda_pdfMatch9.3.17
OR
sodapdfsoda_pdf_desktopMatch10.2.09
OR
sodapdfsoda_pdf_desktopMatch10.2.16.1217
OR
soft-xpansionperfect_pdf_10Match10.0.0.1premium
OR
soft-xpansionperfect_pdf_readerMatch13.0.3
OR
soft-xpansionperfect_pdf_readerMatch13.1.5
OR
tracker-softwarepdf-xchange_editorMatch7.0.237.1
OR
tracker-softwarepdf-xchange_editorMatch7.0.326
OR
tracker-softwarepdf-xchange_viewerMatch2.5
OR
visagesoftexpert_pdf_readerMatch9.0.180
Node
applemacosMatch-
AND
foxitsoftwarefoxit_readerMatch9.1.0
OR
foxitsoftwarefoxit_readerMatch9.2.0
OR
iskysoftpdf_editor_6Match6.6.2.3315professional
OR
iskysoftpdf_editor_6Match6.7.6.3399professional
OR
iskysoftpdfelement6Match6.7.1.3355professional
OR
iskysoftpdfelement6Match6.7.6.3399professional
OR
qoppapdf_studioMatch12.0.7professional
OR
qoppapdf_studio_viewer_2018Match2018.0.1
OR
qoppapdf_studio_viewer_2018Match2018.2.0
Node
linuxlinux_kernelMatch-
AND
foxitsoftwarefoxit_readerMatch9.1.0
OR
foxitsoftwarefoxit_readerMatch9.2.0
OR
qoppapdf_studioMatch12.0.7professional
OR
qoppapdf_studio_viewer_2018Match2018.0.1
OR
qoppapdf_studio_viewer_2018Match2018.2.0

Related

cve 1
prion 1
cvelist 1
kaspersky 1
nessus 3
openvas 2
cve
cve
CVE-2018-18689
2021-01-07 18:15:12
prion
prion
Design/Logic Flaw
2021-01-07 18:15:00
cvelist
cvelist
CVE-2018-18689
2021-01-07 17:59:16
kaspersky
kaspersky
KLA11398 Multiple vulnerabilities in Foxit Reader and Foxit PhantomPDF
2019-01-10 00:00:00
nessus
nessus
Foxit PhantomPDF < 9.4 Multiple Vulnerabilities
2019-01-09 00:00:00
Foxit Reader < 9.4 Multiple Vulnerabilities
2019-01-09 00:00:00
Foxit PhantomPDF < 8.3.9 Multiple Vulnerabilities
2019-01-18 00:00:00
openvas
openvas
Foxit Reader Multiple Vulnerabilities (Jan 2019) - Windows
2019-01-04 00:00:00
Foxit PhantomPDF < 9.4 Multiple Vulnerabilities (Jan 2019) - Windows
2019-01-04 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.0%

JSON
Related for NVD:CVE-2018-18689
cve1prion1cvelist1kaspersky1nessus3openvas2