« Volver al listado

CVE-2024-9244

Estado: AnalizadaAlta (7.8)—

Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-23933.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict File and Directory PermissionsPrivileged Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (2)

Foxit — PDF EditorFoxit — PDF Reader

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-9244",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9244",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-25T18:40:29.211815Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Foxit",
          "product": "PDF Reader",
          "versions": [
            {
              "status": "affected",
              "version": "2024.1.0.23997"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:foxit:pdf_reader:-:*:*:*:*:*:*:*"
          ],
          "vendor": "foxit",
          "product": "pdf_reader",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2024.2.3.25184",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-22T22:15:20.383",
  "references": [
    {
      "url": "https://www.foxit.com/support/security-bulletins.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1298/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-23933."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de escalamiento de privilegios locales por asignación incorrecta de permisos en el servicio de actualización de Foxit PDF Reader. Esta vulnerabilidad permite a los atacantes locales escalar privilegios en las instalaciones afectadas de Foxit PDF Reader. Un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para explotar esta vulnerabilidad. La falla específica existe en el manejo de los archivos de configuración utilizados por el servicio de actualización de Foxit Reader. El problema es el resultado de permisos incorrectos establecidos en un recurso utilizado por el servicio. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar código en el contexto de SYSTEM. Era ZDI-CAN-23933."
    }
  ],
  "lastModified": "2026-06-17T08:24:12.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C7BE041-2E6C-4A13-B2BB-B6793DD6333C",
              "versionEndIncluding": "11.2.10.53951"
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFDD86B9-CB6A-4BAD-83BC-ECFAE6E5B636",
              "versionEndIncluding": "12.1.7.15526",
              "versionStartIncluding": "12.0"
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33BA7066-6149-4394-93EE-3B25D0B55B00",
              "versionEndIncluding": "13.1.3.22478",
              "versionStartIncluding": "13.0"
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1CC457C-855D-4F86-92A5-49F5F5E43FDE",
              "versionEndIncluding": "2023.3.0.23028",
              "versionStartIncluding": "2023.0"
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B13D9F9-C28D-4020-9A3A-D41943BA48ED",
              "versionEndIncluding": "2024.2.3.25184",
              "versionStartIncluding": "2024.0"
            },
            {
              "criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "247044FE-22C2-4ACA-B9EA-CBB24B4EE26D",
              "versionEndIncluding": "2024.2.3.25184"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}