GitHub Advisoryadvisory · Packagist

GHSA-3vjh-xrhf-v9xh Improper Restriction of XML External Entity Reference in dompdf/dompdf

CRITICAL Published 2024-11-15 Modified 2024-11-18 Official page ↗
Aliases
CVE-2021-3902
Ecosystem
Packagist
Packages
dompdf/dompdf
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2024-11-15

Affected packages

• Packagist dompdf/dompdf: < 2.0.0 → fixed in 2.0.0

Description

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Related

Alias · CVE (1)

  • CVE-2021-3902 An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References