CVE-2024-29072

2024-05-2814:15:12

CWE-295

[email protected]

web.nvd.nist.gov

nvd

cve-2024-29072

foxit reader

privilege escalation

improper certification validation

updater executable

low privilege user

update action

unexpected elevation

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

Percentile

9.0%

JSON

A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the updater executable before executing it. A low privilege user can trigger the update action which can result in unexpected elevation of privilege.