Log in Start free

Vulnerability · Published Nov 26, 2023 · Assigned by VulDB

CVE-2023-6298Apryse iText PdfDocument.java main array index

Medium 4.3

In plain English

A medium-severity security flaw in iText from Apryse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.1%top 33.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSlibitext5-javano fix listedUBUNTU-CVE-2023-6298
Ubuntu:24.04:LTSlibitext5-javano fix listedUBUNTU-CVE-2023-6298
Ubuntu:25.10libitext5-javano fix listedUBUNTU-CVE-2023-6298
Ubuntu:26.04:LTSlibitext5-javano fix listedUBUNTU-CVE-2023-6298
Ubuntu:26.10libitext5-javano fix listedUBUNTU-CVE-2023-6298

Affected products (as reported)

VendorProductVersions
Apryse iText 8.0.2

Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References