// For flags

CVE-2023-39505

PDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability

Severity Score

5.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

PDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the Net.HTTP.requests method. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to disclose information in the context of the current user. Was ZDI-CAN-20211.

PDF-XChange Editor Net.HTTP.requests Vulnerabilidad de divulgación de información de función peligrosa expuesta. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe dentro del método Net.HTTP.requests. El problema resulta de la exposición de una función peligrosa. Un atacante puede aprovechar esta vulnerabilidad para revelar información en el contexto del usuario actual. Fue ZDI-CAN-20211.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the Net.HTTP.requests method. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to disclose information in the context of the current user.

*Credits: Andrea Micalizzi aka rgod
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-08-02 CVE Reserved
  • 2023-08-17 CVE Published
  • 2024-05-03 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-749: Exposed Dangerous Method or Function
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
PDF-XChange
Search vendor "PDF-XChange"
PDF-XChange Editor
Search vendor "PDF-XChange" for product "PDF-XChange Editor"
9.5.366.0
Search vendor "PDF-XChange" for product "PDF-XChange Editor" and version "9.5.366.0"
en
Affected