Cross-Site Scripting Vulnerability in Foxit PDF SDK for Web
CVE-2021-27517

6.1MEDIUM

Key Information:

Vendor
Foxit
Status
PhantomPDF
Reader
Vendor
CVE Published:
20 July 2021

Summary

Foxit PDF SDK for Web versions up to 7.5.0 are susceptible to a Cross-Site Scripting vulnerability. This issue can be exploited when a victim uploads a specially crafted PDF document that contains embedded JavaScript. This document can execute arbitrary JavaScript code in the victim's browser by misusing the app.alert function in the Acrobat JavaScript API, potentially compromising the user's data and security.

References

https://www.foxitsoftware.com/support/security-bulletins....
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.