CyberSec.Space Logo
Back to CVE Browser

CVE-2019-12154

CRITICAL
9.1
CVSS Severity Score
EPSS Score0.1610%
EPSS Percentile7.72th
PublishedJun 11, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.

Affected Platforms (CPE)

📦
Realobjects

Pdfreactor

< 10.1.10722

References & Advisories

🔗 https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html
🔗 https://www.pdfreactor.com/important-pdfreactor-security-advisory/
🔗 https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/
🔗 https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html
🔗 https://www.pdfreactor.com/important-pdfreactor-security-advisory/
🔗 https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/

Related Vulnerabilities

CVE-2019-1215310.0

Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access netw...

CVE-2019-390510.0

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

CVE-2019-002010.0

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full contr...

CVE-2019-002210.0

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full contro...