CVE-2008-20001: high-severity vulnerability in activePDF WebGrabber
activePDF WebGrabber ActiveX Control Buffer Overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 1.6%
from disclosure to weaponsame day
Published on NVDAug 30
metasploitAug 26
activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although the control is not marked safe for scripting, exploitation is possible via crafted HTML content in Internet Explorer under permissive security settings.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
activePDF · WebGrabberReferences
https://documentation.activepdf.com/WebGrabber_GS/b_installation/New_Installation.htmlhttps://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/activepdf_webgrabber.rbhttps://support.activepdf.com/support/solutions/35000139131https://web.archive.org/web/20081219180353/http://www.activepdf.com/products/serverproducts/webgrabber/https://www.exploit-db.com/exploits/16635https://www.vulncheck.com/advisories/activepdf-webgrabber-activex-control-buffer-overflow