An arbitrary file creation vulnerability exists in the Javascript exportDataObject...
Vulnerability Description
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-35985
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Discovered by Kamlapati Choubey of Cisco Talos.
More from Foxit
View All →Affected Vendor
Foxit
View all reports →