« Volver al listado

CVE-2021-27517

Estado: ModificadaMedia (6.1)—

Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Foxit — PhantompdfFoxit — Reader

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27517",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-20T12:15:07.810",
  "references": [
    {
      "url": "https://www.foxitsoftware.com/support/security-bulletins.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.foxitsoftware.com/support/security-bulletins.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API)."
    },
    {
      "lang": "es",
      "value": "Foxit PDF SDK For Web versiones hasta 7.5.0, permite un ataque de tipo XSS. Se presenta una ejecución de código JavaScript arbitrario en el navegador si una víctima carga un documento PDF malicioso conteniendo código JavaScript insertado que abusa de app.alert (en la API JavaScript de Acrobat)"
    }
  ],
  "lastModified": "2026-06-17T03:45:00.793",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:foxit:phantompdf:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5F3D9B7-AEAA-4E90-A9D8-C1AF41BCACFE",
              "versionEndIncluding": "9.7.5.29616"
            },
            {
              "criteria": "cpe:2.3:a:foxit:phantompdf:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40024316-5FEA-442E-B66D-6FCFE3F6F197",
              "versionEndIncluding": "10.1.3.37598",
              "versionStartIncluding": "10.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:foxit:reader:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA30696D-7425-4588-8D64-C5AAC7EE65D0",
              "versionEndIncluding": "10.1.3.37598"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}