CVE-2022-28368

Опубликовано: 03 апр. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Ссылки

http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
Patch
Third Party Advisory
https://github.com/dompdf/dompdf/issues/2598
Patch
Third Party Advisory
https://github.com/dompdf/dompdf/pull/2808
Patch
Third Party Advisory
https://github.com/snyk-labs/php-goof
Third Party Advisory
https://packagist.org/packages/dompdf/dompdf#v1.2.1
Product
Third Party Advisory
https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
Patch
Third Party Advisory
https://github.com/dompdf/dompdf/issues/2598
Patch
Third Party Advisory
https://github.com/dompdf/dompdf/pull/2808
Patch
Third Party Advisory
https://github.com/snyk-labs/php-goof
Third Party Advisory
https://packagist.org/packages/dompdf/dompdf#v1.2.1
Product
Third Party Advisory
https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*

Версия до 1.2.1 (исключая)

EPSS

Процентиль: 99%

0.72243

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2022-28368

CVSS3: 9.8

ubuntu

почти 4 года назад

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

CVE-2022-28368

CVSS3: 9.8

debian

почти 4 года назад

Dompdf 1.2.1 allows remote code execution via a .php file in the src:u ...

GHSA-x752-qjv4-c4hc

CVSS3: 9.8

github

почти 4 года назад

Remote code injection in dompdf/dompdf

EPSS

Процентиль: 99%

0.72243

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-79