// For flags

CVE-2023-41257

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

Existe una vulnerabilidad de confusión de tipos en la forma en que Foxit Reader 12.1.2.15356 maneja las propiedades de los valores de los campos. Un código Javascript especialmente manipulado dentro de un documento PDF malicioso puede desencadenar esta vulnerabilidad, lo que puede provocar daños en la memoria y provocar la ejecución de código arbitrario. Un atacante debe engañar al usuario para que abra el archivo malicioso para desencadenar esta vulnerabilidad. La explotación también es posible si un usuario visita un sitio malicioso especialmente manipulado si la extensión del complemento del navegador está habilitada.

*Credits: Discovered by Kamlapati Choubey of Cisco Talos.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-09-01 CVE Reserved
  • 2023-11-27 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-10-27 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CAPEC
References (1)
URL Tag Source
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1838 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Foxitsoftware
Search vendor "Foxitsoftware"
 Foxit Reader
Search vendor "Foxitsoftware" for product "Foxit Reader"
 12.1.3.15356
Search vendor "Foxitsoftware" for product "Foxit Reader" and version "12.1.3.15356"
-
Affected