Vulnerability · Published May 18, 2020 · Assigned by talos
CVE-2020-6093
Medium 6.5
In plain English
A medium-severity security flaw in Nitro Pro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)2.7%top 13.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability, victim must open a malicious file.
Affected products (as reported)
Weakness: CWE-824 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1014 x_refsource_MISC