Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2020-29599

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

  • Published: Dec 7, 2020
  • Updated: Apr 14, 2023
  • CVE: CVE-2020-29599
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.8
  • AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
imagemagick / imagemagick 6.9.8-1 6.9.11-40
imagemagick / imagemagick 7.0.5-3 7.0.10-40
debian / debian_linux 9.0 9.0.x