CVE-2020-13804: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Foxit Reader and PhantomPDF before version 9.7.2, identified as CVE-2020-13804. The vulnerability allows information disclosure of hardcoded username and password credentials in the DocuSign plugin. This security issue was disclosed on June 4, 2020 (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v2.0 Base Score is 6.8 (MEDIUM) with the vector string (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability is categorized under CWE-798: Use of Hard-coded Credentials (NVD).

The vulnerability exposes hardcoded username and password credentials in the DocuSign plugin, which could potentially allow attackers to gain unauthorized access to the system or sensitive information (NVD).

The vulnerability requires network access and medium complexity to exploit, with no authentication required. No specific exploit details or reports of exploitation in the wild have been publicly documented (Rapid7).

Users are advised to update to Foxit Reader and PhantomPDF version 9.7.2 or later to address this vulnerability. The fix is available through the vendor's security bulletin (Foxit Security Bulletin).