CVE-2019-8007
published 2019-08-20CVE-2019-8007: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
3.06%
86.2th percentile
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat_dc | >= 15.006.30060 < 15.006.30499 | 15.006.30499 |
| adobe | acrobat_dc | >= 15.008.20082 < 19.012.20036 | 19.012.20036 |
| adobe | acrobat_dc | >= 17.011.30059 < 17.011.30144 | 17.011.30144 |
| adobe | acrobat_reader_dc | >= 15.006.30060 < 15.006.30499 | 15.006.30499 |
| adobe | acrobat_reader_dc | >= 15.008.20082 < 19.012.20036 | 19.012.20036 |
| adobe | acrobat_reader_dc | >= 17.011.30059 < 17.011.30144 | 17.011.30144 |
| adobe | adobe_acrobat_and_reader | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)
exploitdb·2019-04-03·CVSS 7.2
CVE-2019-1653 [HIGH] Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)
Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "Cisco RV320 and RV325 Unauthenticated Remote Code Execution",
'Description' => %q{
This exploit module combines an information disclosure (CVE-2019-1653)
and a command injection vulnerability (CVE-2019-1652) together to gain
unauthenticated remote code execution on Cisco RV320 and RV325 small business
routers. Can be exploited via the WAN interface of the router. Either via HTTPS
on port 443 or HTTP on port 8007 on some older firmware versions.
},
'License' => MSF_LICENSE,
'Author' => [
'RedTeam Pentesting GmbH', # Discovery, Metasploit
'Philip Huppe
Metasploit
Cisco RV320 and RV325 Unauthenticated Remote Code Execution
metasploit·CVSS 7.2
CVE-2019-1653 [HIGH] Cisco RV320 and RV325 Unauthenticated Remote Code Execution
Cisco RV320 and RV325 Unauthenticated Remote Code Execution
This exploit module combines an information disclosure (CVE-2019-1653) and a command injection vulnerability (CVE-2019-1652) together to gain unauthenticated remote code execution on Cisco RV320 and RV325 small business routers. Can be exploited via the WAN interface of the router. Either via HTTPS on port 443 or HTTP on port 8007 on some older firmware versions.
2019-08-20
Published