CVEブラウザに戻る

CVE-2019-12153

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0740%

EPSS Percentile20.26th

Published2019年6月11日

Last Modified2024年11月21日

Vulnerability Description

Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content.

Affected Platforms (CPE)

📦

Realobjects

Pdfreactor

< 10.1.10722

References & Advisories

🔗 https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html

🔗 https://www.pdfreactor.com/important-pdfreactor-security-advisory/

🔗 https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/

🔗 https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html

🔗 https://www.pdfreactor.com/important-pdfreactor-security-advisory/

🔗 https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/

関連する脆弱性情報

CVE-2019-121549.1

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in exte...

CVE-2019-700310.0

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execu...

CVE-2019-877910.0

A logic issue applied the incorrect restrictions. This issue was addressed by updating the logic to apply the correct restrictions...

CVE-2019-1744010.0

Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Manage...