XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.
References
| Link | Resource |
|---|---|
| https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html | Third Party Advisory |
| https://www.pdfreactor.com/important-pdfreactor-security-advisory/ | Vendor Advisory |
| https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ | Release Notes Vendor Advisory |
| https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html | Third Party Advisory |
| https://www.pdfreactor.com/important-pdfreactor-security-advisory/ | Vendor Advisory |
| https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 04:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html - Third Party Advisory | |
| References | () https://www.pdfreactor.com/important-pdfreactor-security-advisory/ - Vendor Advisory | |
| References | () https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ - Release Notes, Vendor Advisory |
Information
Published : 2019-06-11 21:29
Updated : 2024-11-21 04:22
NVD link : CVE-2019-12154
Mitre link : CVE-2019-12154
CVE.ORG link : CVE-2019-12154
JSON object : View
Products Affected
realobjects
- pdfreactor
CWE
CWE-611
Improper Restriction of XML External Entity Reference