According to its version, the Foxit PDF Editor application (previously named Foxit PhantomPDF) installed on the remote Windows host is prior to 11.2.1. It is, therefore affected by multiple vulnerabilities:

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file,     potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this     issue requires user interaction in that a victim must open a malicious file. (CVE-2021-44708,     CVE-2021-44709)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file.
    An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service     in the context of the current user. Exploitation of this issue requires user interaction in that a victim     must open a malicious file. (CVE-2021-44740, CVE-2021-44741)

  - Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net     configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled     log4net configuration files. (CVE-2018-1285)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Foxit PDF Editor < 11.2.1 Multiple Vulnerabilities

critical Nessus Plugin ID 157230

Version 1.10

Version 1.9

Version 1.9

Version 1.10 Oct 9, 2023, 7:01 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310091901
Version 1.9 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254
Version 1.9 Oct 9, 2023, 5:00 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Detection Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310091700