CVE-2022-37377
Foxit PDF Editor JavaScript Optimization Type Confusion Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaScript optimizations. The issue results from an improper optimization, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16733.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within JavaScript optimizations. The issue results from an improper optimization, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-08-02 CVE Reserved
- 2022-08-05 CVE Published
- 2024-08-03 CVE Updated
- 2024-09-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-22-1049 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.foxit.com/support/security-bulletins.html | 2023-04-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Foxit Search vendor "Foxit" | Pdf Editor Search vendor "Foxit" for product "Pdf Editor" | < 10.1.9 Search vendor "Foxit" for product "Pdf Editor" and version " < 10.1.9" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Foxit Search vendor "Foxit" | Pdf Editor Search vendor "Foxit" for product "Pdf Editor" | >= 11.0.0 < 11.2.3 Search vendor "Foxit" for product "Pdf Editor" and version " >= 11.0.0 < 11.2.3" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Foxit Search vendor "Foxit" | Pdf Editor Search vendor "Foxit" for product "Pdf Editor" | 12.0.0.12394 Search vendor "Foxit" for product "Pdf Editor" and version "12.0.0.12394" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Foxit Search vendor "Foxit" | Pdf Reader Search vendor "Foxit" for product "Pdf Reader" | < 12.0.1 Search vendor "Foxit" for product "Pdf Reader" and version " < 12.0.1" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|