CVE-2023-49147
High
Description
An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on faxPrnInst.log) to open a SYSTEM cmd.exe.
SeverityHigh
CVSS7.8
Exploit probability—
ProductPdf24 Creator
PublishedDec 19, 2023
First seenDec 19, 2023
How to fix
Update
- pdf24 pdf24_creator11.15.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pdf24 pdf24_creator | v < 11.15.2 | 11.15.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.