CVE-2022-28368

CRITICAL9.8EPSS 88.3%

Remote code injection in dompdf/dompdf

發布日:2022/4/4修改日:2024/2/16

描述

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

受影響套件(1)

Packagist/dompdf/dompdffrom 0, < 1.2.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(11)

ADVISORYhttps://github.com/advisories/GHSA-x752-qjv4-c4hc
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-28368
PATCHhttps://github.com/dompdf/dompdf
WEBhttp://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
WEBhttps://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
WEBhttps://github.com/dompdf/dompdf/issues/2598
WEBhttps://github.com/dompdf/dompdf/pull/2808
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-28368.yaml
WEBhttps://github.com/snyk-labs/php-goof
WEBhttps://packagist.org/packages/dompdf/dompdf#v1.2.1
WEBhttps://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce