« Volver al listado

CVE-2017-8059

Estado: ModificadaAlta (8.1)—

La aceptación de certificados TLS inválidos y autofirmados en "Foxit PDF - PDF reader, editor, form, signature" anterior a versión 5.4 para iOS, permite a un atacante tipo man-in-the-middle y/o físicamente cercano interceptar silenciosamente información del inicio de sesión (nombre de usuario y contraseña), además del token de autenticación estática si el usuario ya ha iniciado sesión.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Foxitsoftware — Foxit PDF

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8059",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-05T07:29:01.200",
  "references": [
    {
      "url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Acceptance of invalid/self-signed TLS certificates in \"Foxit PDF - PDF reader, editor, form, signature\" before 5.4 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information (username/password), in addition to the static authentication token if the user is already logged in."
    },
    {
      "lang": "es",
      "value": "La aceptación de certificados TLS inválidos y autofirmados en \"Foxit PDF - PDF reader, editor, form, signature\" anterior a versión 5.4 para iOS, permite a un atacante tipo man-in-the-middle y/o físicamente cercano interceptar silenciosamente  información del inicio de sesión (nombre de usuario y contraseña), además del token de autenticación estática si el usuario ya ha iniciado sesión."
    }
  ],
  "lastModified": "2026-06-17T01:25:42.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:foxitsoftware:foxit_pdf:5.2.1:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDF35C87-2765-4921-82C2-3FE05193E1D1"
            },
            {
              "criteria": "cpe:2.3:a:foxitsoftware:foxit_pdf:5.3.2:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E457088-8FD5-4FCC-B21A-BB71D53297AA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}