Files or Directories Accessible to External Parties in Expert PDF - CVE-2020-35340

Vulnerability identifier: #VU59174

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-35340

CWE-ID: CWE-552

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Local File Inclusion. A remote attacker can read the file contents from files that the running ExpertPDF process has access to read.

Expert PDF
Agilia Partner maintenance
Vigilant Software Suite
Agilia Link+
Agilia Connect WiFi module of the pumps

Install updates from vendor's website.

Expert PDF - update to 15.0.0
Agilia Partner maintenance - update to 3.3.2
Vigilant Software Suite - update to 1.0.3
Agilia Link+ - update to 3.0 D16
Agilia Connect WiFi module of the pumps - update to D29

• https://optionalctf.com/cve-2020-35340-local-file-inclusion-in-expertpdf-9-5-0-14-1-0/

• Information disclosure in ExpertPDF
• Multiple vulnerabilities in Fresenius Kabi Agilia Connect Infusion System