CVE-2024-29072

A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the updater executable before executing it. A low privilege user can trigger the update action which can result in unexpected elevation of privilege.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1989	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1989	Exploit Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1989	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1989	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_reader::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-05-28 14:15

Updated : 2025-08-22 16:03

NVD link : CVE-2024-29072

Mitre link : CVE-2024-29072

CVE.ORG link : CVE-2024-29072

JSON object : View

Products Affected

microsoft

windows

foxit

pdf_reader
pdf_editor

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2024-29072", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2024-05-28T14:15:12.493", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1989", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1989", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1989", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1989", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the updater executable before executing it. A low privilege user can trigger the update action which can result in unexpected elevation of privilege."}, {"lang": "es", "value": "Existe una vulnerabilidad de escalada de privilegios en Foxit Reader 2024.2.0.25138. La vulnerabilidad se produce debido a una validaci\u00f3n de certificaci\u00f3n inadecuada del ejecutable del actualizador antes de ejecutarlo. Un usuario con privilegios bajos puede desencadenar la acci\u00f3n de actualizaci\u00f3n, lo que puede resultar en una elevaci\u00f3n inesperada de privilegios."}], "lastModified": "2025-08-22T16:03:32.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "310F9865-EAB7-4537-B205-CE25418D5A3B", "versionEndIncluding": "11.2.9.53938"}, {"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3F78536-999B-4FAA-9F7D-C35621384E87", "versionEndIncluding": "12.1.6.15509", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BED878DD-2908-49CE-8248-1A950D9F750D", "versionEndIncluding": "13.1.1.22432", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64", "versionEndIncluding": "2023.3.0.23028", "versionStartIncluding": "2023.1.0.15510"}, {"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEE05FE1-67A3-4AE1-B49B-3C497E7D944B", "versionEndIncluding": "2024.2.1.25153", "versionStartIncluding": "2024.1.0.23997"}, {"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "525AF74D-C7F7-466E-9501-60B489C7803F", "versionEndIncluding": "2024.2.1.25153"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}