CVE-2023-27363
Estado: AnalizadaAlta (7.8)—💥 PoC
Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 47%
- Percentil entre todas las CVEs puntuadas: 99
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub
⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.
Tecnologías afectadas (2)
CWE
- CWE-749
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-27363",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-27363",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-07-01T20:58:42.481767Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "zdi-disclosures@trendmicro.com",
"affectedData": [
{
"vendor": "Foxit",
"product": "PDF Reader",
"versions": [
{
"status": "affected",
"version": "12.1.0.15250"
}
],
"defaultStatus": "unknown"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:foxit:phantompdf:*:*:*:*:*:*:*:*"
],
"vendor": "foxit",
"product": "phantompdf",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "10.1.11.37866",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:foxit:pdf_editor:11.0.0:*:*:*:*:*:*:*"
],
"vendor": "foxit",
"product": "pdf_editor",
"versions": [
{
"status": "affected",
"version": "11.0.0",
"versionType": "custom",
"lessThanOrEqual": "11.2.5.53785"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*"
],
"vendor": "foxit",
"product": "pdf_editor",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "10.1.11.37866"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:foxit:phantompdf:*:*:*:*:*:*:*:*"
],
"vendor": "foxit",
"product": "phantompdf",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "10.1.11.37866"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-05-03T02:15:14.530",
"references": [
{
"url": "https://www.foxit.com/support/security-bulletins.html",
"tags": [
"Vendor Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-491/",
"tags": [
"Third Party Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.foxit.com/support/security-bulletins.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-491/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"description": [
{
"lang": "en",
"value": "CWE-749"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697."
},
{
"lang": "es",
"value": "Foxit PDF Reader exportXFAData Vulnerabilidad de ejecución remota de código de método peligroso expuesto. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Foxit PDF Reader. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe dentro del método exportXFAData. La aplicación expone una interfaz JavaScript que permite escribir archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del usuario actual. Era ZDI-CAN-19697."
}
],
"lastModified": "2026-06-17T05:44:52.670",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89043BBE-91B1-489A-BA87-18BB6DB0ED8E",
"versionEndExcluding": "10.1.11.37866"
},
{
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3781AC17-510F-4EDD-9952-14DE943A437E",
"versionEndExcluding": "11.2.5.53785",
"versionStartIncluding": "11.0.0.49893"
},
{
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1402921F-15A0-4896-9182-4C6E82B0FFE9",
"versionEndExcluding": "12.1.1.15289",
"versionStartIncluding": "12.0.0.12394"
},
{
"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58DD497A-7C5C-456B-9E6E-D102258B1FFD",
"versionEndExcluding": "12.1.1.15289"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com"
}