Information disclosure in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU101824
Published: December 18, 2024 / Updated: December 18, 2024
Vulnerability identifier: #VU101824
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the application fails to provide a reasonable prompt for user
confirmation when executing the “app.openDoc”/“LaunchAction” functions,
or ignores the encryption elements and transmits form content in clear
text without a proper prompt for users. A remote attacker can trick the victim into opening a specially crafted XFA file and gain access to sensitive information.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Mac
Foxit PDF Editor for Mac (formerly PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Mac
Foxit PDF Editor for Mac (formerly PhantomPDF)
Remediation
Install updates from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 11.2.12.54161, 12.1.9.15762, 13.1.5.23566, 2024.4.0.27683
Foxit PDF Reader for Windows - update to 2024.4.0.27683
Foxit PDF Reader for Mac - update to 2024.4.0
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 11.1.11.1202, 12.1.7.55606, 13.1.5.63001, 2024.4.0.66473
Foxit PDF Reader for Windows - update to 2024.4.0.27683
Foxit PDF Reader for Mac - update to 2024.4.0
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 11.1.11.1202, 12.1.7.55606, 13.1.5.63001, 2024.4.0.66473