CVEvulnerability
CVE-2019-12154
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.1 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-611
Description
XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.
Affected configurations
• realobjects pdfreactor (< 10.1.10722)
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html Third Party Advisory
- https://www.pdfreactor.com/important-pdfreactor-security-advisory/ Vendor Advisory
- https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ Release Notes, Vendor Advisory
- https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html Third Party Advisory
- https://www.pdfreactor.com/important-pdfreactor-security-advisory/ Vendor Advisory
- https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ Release Notes, Vendor Advisory