Unscored CVE-2021-39307 EUVD-2021-25668GHSA-h97p-5fjq-c93c

PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the ex…

Published Sep 15, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.

References

https://www.pdftron.com/webviewer/
https://research.nccgroup.com/2021/09/14/technical-advisory-pdftron-javascript-urls-allowed-in-webviewer-ui-cve-2021-39307/