ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ PHP-Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠΈ Π³Π΅Π½Π΅ΡΠ°ΡΠΈΠΈ PDF-Π΄ΠΎΠΊΡΠΌΠ΅Π½ΡΠΎΠ² ΠΈΠ· HTML-ΡΠ°Π·ΠΌΠ΅ΡΠΊΠΈ ΠΈ CSS-ΡΡΠΈΠ»Π΅ΠΉ Dompdf ΡΠ²ΡΠ·Π°Π½Π° Ρ Π½Π΅Π²Π΅ΡΠ½ΡΠΌ ΠΏΠΎΡΡΠ΄ΠΊΠΎΠΌ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ Π°Π²ΡΠΎΡΠΈΠ·Π°ΡΠΈΡ ΠΏΠ΅ΡΠ΅Π΄ ΡΠΈΠ½ΡΠ°ΠΊΡΠΈΡΠ΅ΡΠΊΠΈΠΌ Π°Π½Π°Π»ΠΈΠ·ΠΎΠΌ ΠΈ ΠΊΠ°Π½ΠΎΠ½ΠΈΠ·Π°ΡΠΈΠ΅ΠΉ ΠΏΡΠΈ ΠΎΠ±ΡΠ°Π±ΠΎΡΠΊΠ΅ ΡΠ΅Π³ΠΎΠ² Ρ Π·Π°Π³Π»Π°Π²Π½ΡΠΌΠΈ Π±ΡΠΊΠ²Π°ΠΌΠΈ. ΠΠΊΡΠΏΠ»ΡΠ°ΡΠ°ΡΠΈΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ ΠΌΠΎΠΆΠ΅Ρ ΠΏΠΎΠ·Π²ΠΎΠ»ΠΈΡΡ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ, Π΄Π΅ΠΉΡΡΠ²ΡΡΡΠ΅ΠΌΡ ΡΠ΄Π°Π»Π΅Π½Π½ΠΎ, ΡΠ΄Π°Π»ΠΈΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠ΅ ΡΠ°ΠΉΠ»Ρ ΠΈΠ»ΠΈ Π²ΡΠΏΠΎΠ»Π½ΠΈΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠΉ ΠΊΠΎΠ΄
ΠΠ΅Π½Π΄ΠΎΡ
ΠΠ°ΠΈΠΌΠ΅Π½ΠΎΠ²Π°Π½ΠΈΠ΅ ΠΠ
ΠΠ΅ΡΡΠΈΡ ΠΠ
Π’ΠΈΠΏ ΠΠ
ΠΠΏΠ΅ΡΠ°ΡΠΈΠΎΠ½Π½ΡΠ΅ ΡΠΈΡΡΠ΅ΠΌΡ ΠΈ Π°ΠΏΠΏΠ°ΡΠ°ΡΠ½ΡΠ΅ ΠΏΠ»Π°ΡΡΠΎΡΠΌΡ
Π£ΡΠΎΠ²Π΅Π½Ρ ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
ΠΠΎΠ·ΠΌΠΎΠΆΠ½ΡΠ΅ ΠΌΠ΅ΡΡ ΠΏΠΎ ΡΡΡΡΠ°Π½Π΅Π½ΠΈΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Π‘ΡΠ°ΡΡΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
ΠΠ°Π»ΠΈΡΠΈΠ΅ ΡΠΊΡΠΏΠ»ΠΎΠΉΡΠ°
ΠΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ ΠΎΠ± ΡΡΡΡΠ°Π½Π΅Π½ΠΈΠΈ
ΠΠ΄Π΅Π½ΡΠΈΡΠΈΠΊΠ°ΡΠΎΡΡ Π΄ΡΡΠ³ΠΈΡ ΡΠΈΡΡΠ΅ΠΌ ΠΎΠΏΠΈΡΠ°Π½ΠΈΠΉ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ
- CVE
EPSS
10 Critical
CVSS3
10 Critical
CVSS2
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 ...
Dompdf vulnerable to URI validation failure on SVG parsing
EPSS
10 Critical
CVSS3
10 Critical
CVSS2