CVE-2018-19445 — Command Injection in Foxit PDF SDK Activex

CWE-77 — Command Injection3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.9%
top 23.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Foxitsoftware Foxit PDF SDK Activex
Timeline
PublishedJun 17
Latest updateMay 24

Description

A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: www.foxitsoftware.com ↗Patch: www.foxitsoftware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5fx6-gr9q-r6cw: A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5↗2022-05-24
▶
CVEList
CVE-2018-19445: A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5↗2019-06-17
▶
CVE-2018-19445 — Command Injection | cvebase