CRITICAL🇬🇧 English

CVE-2022-28368

CVSS 9.8v3.1pub. 2022-04-03upd. 2024-11-21

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dompdf Project Dompdf

    APP
    Dompdf Project
    < 1.2.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCEXSS
CWE
Referencje

Powiązane podatności

CVE-2021-3838CRITICAL9.8PL ✓ten sam produkt

RCE przez PHAR deserialization w DomPDF przed wersją 2.0.0

CVE-2021-3902CRITICAL9.8PL ✓ten sam produkt

XXE w parserze SVG biblioteki dompdf umożliwia SSRF i PHAR deserialization

CVE-2023-24813CRITICAL10.0ten sam produkt

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and...

CVE-2023-23924CRITICAL10.0ten sam produkt

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passi...

CVE-2022-41343HIGH7.5ten sam produkt

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation f...