CVE-2021-3902
Improper Restriction of XML External Entity Reference in dompdf/dompdf
9.8
CRITICAL
CVSS 3.1
EPSS 0.92%
Description
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
How to fix CVE-2021-3902
To remediate CVE-2021-3902, upgrade the affected package to a fixed version below.
- —upgrade to 2.0.2+dfsg-1 or later
- —upgrade to 2.0.0 or later
Is CVE-2021-3902 being exploited?
Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.0.2+dfsg-1
- from 0, < 2.0.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |