Vulnerabilities > CVE-2020-6093 - Access of Uninitialized Pointer vulnerability in Gonitro Nitro PRO 13.9.1.155

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
local
low complexity
gonitro
CWE-824
NVD
Published: 2020-05-18
Updated: 2022-05-12

Summary

An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability, victim must open a malicious file.

Vulnerable Configurations

Part Description Count
Application
Gonitro
1

Common Weakness Enumeration (CWE)

Talos

idTALOS-2020-1014
last seen2020-05-21
published2020-05-18
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1014
titleNitro Pro PDF Javascript XML error handling Information Disclosure Vulnerability

References