CVE-2020-13805: Critical severity foxit phantompdf vulnerability
Published Jun 4, 2020
·Updated
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures.
Affected Software
2 affected components
Foxitsoftware Phantompdf<9.7.2
Foxitsoftware Reader<9.7.2
Remediation
Patch Available
Event History
Jun 4, 2020
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-13805.
2
What is the severity of CVE-2020-13805?
The severity of CVE-2020-13805 is critical with a score of 9.8.
3
What software is affected by CVE-2020-13805?
Foxit Reader and PhantomPDF versions up to 9.7.2 are affected by CVE-2020-13805.
4
What is the issue with Foxit Reader and PhantomPDF?
The CAS service in Foxit Reader and PhantomPDF lacks a limit on login failures, making them vulnerable to brute-force attacks.
5
How can I fix CVE-2020-13805?
To fix CVE-2020-13805, upgrade Foxit Reader and PhantomPDF to version 9.7.2 or higher.