CVE-2015-2789

Опубликовано: 30 мар. 2015

Источник: nvd

CVSS2: 4.4

EPSS Низкий

Описание

Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.1 through 7.0.6.1126 allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.

Комментарий

CWE-426: Untrusted Search Path

Ссылки

http://packetstormsecurity.com/files/130840/Foxit-Reader-7.0.6.1126-Privilege-Escalation.html
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/36390
Exploit
Third Party Advisory
VDB Entry
http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25
Patch
Vendor Advisory
http://www.securityfocus.com/bid/73432
http://www.securitytracker.com/id/1031879
Third Party Advisory
VDB Entry
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5235.php
Third Party Advisory
http://packetstormsecurity.com/files/130840/Foxit-Reader-7.0.6.1126-Privilege-Escalation.html
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/36390
Exploit
Third Party Advisory
VDB Entry
http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25
Patch
Vendor Advisory
http://www.securityfocus.com/bid/73432
http://www.securitytracker.com/id/1031879
Third Party Advisory
VDB Entry
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5235.php
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:foxitsoftware:foxit_reader:6.1:*:*:*:*:*:*:*

cpe:2.3:a:foxitsoftware:foxit_reader:6.1.2:*:*:*:*:*:*:*

cpe:2.3:a:foxitsoftware:foxit_reader:6.1.4:*:*:*:*:*:*:*

cpe:2.3:a:foxitsoftware:foxit_reader:6.2:*:*:*:*:*:*:*

cpe:2.3:a:foxitsoftware:foxit_reader:6.2.1:*:*:*:*:*:*:*

cpe:2.3:a:foxitsoftware:foxit_reader:7.0:*:*:*:*:*:*:*

cpe:2.3:a:foxitsoftware:foxit_reader:7.0.6:*:*:*:*:*:*:*

EPSS

Процентиль: 39%

0.00176

Низкий

4.4 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-pfjw-vh8j-x52x

github

больше 3 лет назад