Back to CVE Browser

CVE-2019-12153

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0740%

EPSS Percentile20.26th

PublishedJun 11, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content.

Affected Platforms (CPE)

📦

Realobjects

Pdfreactor

< 10.1.10722

References & Advisories

🔗 https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html

🔗 https://www.pdfreactor.com/important-pdfreactor-security-advisory/

🔗 https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/

🔗 https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html

🔗 https://www.pdfreactor.com/important-pdfreactor-security-advisory/

🔗 https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/

Related Vulnerabilities

CVE-2019-121549.1

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in exte...

CVE-2019-623510.0

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12...

CVE-2019-420210.0

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted requ...

CVE-2019-917410.0

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1....