CVE-2018-21242: 
Foxit PhantomPDF vulnerability analysis and mitigation

An issue was discovered in Foxit PhantomPDF before version 8.3.6 that allows Remote Code Execution via a GoToE or GoToR action. The vulnerability is tracked as CVE-2018-21242 and has a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability has a CVSS v2.0 base score of 7.5 HIGH (Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P). The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) according to NIST (NVD).

If exploited, this vulnerability allows attackers to execute remote code on the target system with high impacts on confidentiality, integrity, and availability of the system. The CVSS score of 9.8 indicates critical severity with potential for complete compromise of the affected system (NVD).

The vulnerability has a low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) to exploit. It can be accessed from the network (AV:N), making it highly exploitable (NVD).

Users should upgrade to Foxit PhantomPDF version 8.3.6 or later to address this vulnerability. The fix is available through the vendor's security bulletin (Vendor Advisory).