CVE-2022-30351

Katalog CVE

CVSS 7.5 · High EPSS 0,57%

Kerentanan Improper Encoding or Escaping of Output pada pdfzorro. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images and text embedded in the PDF file, to be leaked unintentionally. In cases where PDF text objects are present it is possible to copy-paste redacted information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions performed after this feature is triggered are vulnerable.

Rincian

Terbit di NVD

30 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output
CWE-1116: Inaccurate Source Code Comments

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://arxiv.org/pdf/2206.02285.pdf advisory pihak ketiga
• https://www.pdfzorro.com/pdf-edit/ product