CVE-2022-30351 Information disclosure in n/a
Attackers can recover redacted text and images from PDFs processed by PDFZorro Online due to improper sanitization, leading to sensitive data leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-30351?
CVE-2022-30351 is a high-severity vulnerability in n/a, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images and text embedded in the PDF file, to be leaked unintentionally. In cases where PDF text objects are present it is possible to copy-paste redacted information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions performed after this feature is triggered are vulnerable.
Which versions are affected by CVE-2022-30351?
It affects 1 product.
Products include Pdfzorro Pdfzorro.
How do I fix CVE-2022-30351?
No fix has been published for CVE-2022-30351 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30351 being exploited?
There is no known exploitation of CVE-2022-30351 in the wild and no public exploit code.
Sources
Also known as GHSA-v82w-4932-72hf.