CVE-2021-38570: Critical severity Foxitsoftware Foxit Reader vulnerability
Published Aug 11, 2021
·Updated
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
Affected Software
2 affected components
Foxitsoftware Foxit Reader<10.1.4
Foxitsoftware Phantompdf<10.1.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foxit Reader and PhantomPDFto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Aug 11, 2021
CVE Published
via MITRE·09:14 PM
Data Sourced
via MITRE·09:14 PM
Description
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-38570.
2
What is the affected software?
The affected software is Foxit Reader and PhantomPDF before version 10.1.4.
3
What is the severity rating of this vulnerability?
This vulnerability has a severity rating of 9.1 (Critical).
4
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability to delete arbitrary files during uninstallation by using a symlink.
5
Is there any fix available for this vulnerability?
Yes, upgrading to version 10.1.4 or later of Foxit Reader and PhantomPDF can fix this vulnerability.