CVE-2017-7442
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL...
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
- Record
CVE-2017-7442- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
- Record
CVE-2017-7442- Updated
- 2026-11-02
EUVDEUVD-2017-16466 No score
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
- Record
EUVD-2017-16466- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6rfp-cx64-qrwc
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL...
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
- Record
GHSA-6rfp-cx64-qrwc- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Nitro Pro PDF Reader 11.0.3.173 - Javascript API Code Execution (Metasploit) | 2017-08-02 |
| Metasploit | Nitro Pro PDF Reader 11.0.3.173 Javascript API Remote Code Execution | 2017-07-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7442 is a high vulnerability (CVSS 8.8) in Gonitro Nitro Pro, published August 3, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 40.7%, the 98th percentile. No source names a fixed version.