Vulnerability · Published Nov 15, 2024 · Assigned by @huntr_ai
CVE-2021-3902Improper Restriction of XML External Entity Reference in dompdf/dompdf
Critical 9.8
In plain English
A critical-severity XML external entity in dompdf/dompdf from dompdf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-dompdf | 2.0.2+dfsg-1 | DEBIAN-CVE-2021-3902 |
| Packagist | dompdf/dompdf | 2.0.0 | GHSA-3vjh-xrhf-v9xh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dompdf | dompdf/dompdf | unspecified – before 2.0.0 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H