CVE-2009-2993

EUVD-2009-2978

19.10.2009, 22:30

The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and possibly execute arbitrary code, via the cPath parameter in a crafted PDF file.  NOTE: some of these details are obtained from third party information.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.3 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:N/C:C/I:C/A:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 90%

Affected Products (NVD)

Vendor	Product	Version
adobe	acrobat	𝑥 ≤ 9.1.3
adobe	acrobat	7.0
adobe	acrobat	7.0.1
adobe	acrobat	7.0.2
adobe	acrobat	7.0.3
adobe	acrobat	7.0.4
adobe	acrobat	7.0.5
adobe	acrobat	7.0.6
adobe	acrobat	7.0.7
adobe	acrobat	7.0.8
adobe	acrobat	7.0.9
adobe	acrobat	7.1.0
adobe	acrobat	7.1.1
adobe	acrobat	7.1.3
adobe	acrobat	8.0
adobe	acrobat	8.1
adobe	acrobat	8.1.1
adobe	acrobat	8.1.2
adobe	acrobat	8.1.3
adobe	acrobat	8.1.4
adobe	acrobat	8.1.6
adobe	acrobat	9.0
adobe	acrobat	9.1.1
adobe	acrobat	9.1.2
adobe	acrobat_reader	𝑥 ≤ 9.1.3
adobe	acrobat_reader	7.0
adobe	acrobat_reader	7.0.1
adobe	acrobat_reader	7.0.2
adobe	acrobat_reader	7.0.3
adobe	acrobat_reader	7.0.4
adobe	acrobat_reader	7.0.5
adobe	acrobat_reader	7.0.6
adobe	acrobat_reader	7.0.7
adobe	acrobat_reader	7.0.8
adobe	acrobat_reader	7.0.9
adobe	acrobat_reader	7.1.0
adobe	acrobat_reader	7.1.1
adobe	acrobat_reader	7.1.3
adobe	acrobat_reader	8.0
adobe	acrobat_reader	8.1
adobe	acrobat_reader	8.1.1
adobe	acrobat_reader	8.1.2
adobe	acrobat_reader	8.1.3
adobe	acrobat_reader	8.1.4
adobe	acrobat_reader	8.1.5
adobe	acrobat_reader	8.1.6
adobe	acrobat_reader	9.0
adobe	acrobat_reader	9.1
adobe	acrobat_reader	9.1.1
adobe	acrobat_reader	9.1.2