Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
friendsofphpOpenJS FoundationFRIENDSOFPHP:DOMPDF:DOMPDF:CVE-2022-28368
HistoryMar 24, 2022 - 1:59 p.m.

Remote code injection via remote fonts

2022-03-2413:59:00
OpenJS Foundation
github.com
5

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.161 Low

EPSS

Percentile

96.0%

JSON

Description Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file). References https://nvd.nist.gov/vuln/detail/CVE-2022-28368 dompdf/dompdf#2598 dompdf/dompdf#2808 dompdf/dompdf@4c70e10 https://github.com/snyk-labs/php-goof https://packagist.org/packages/dompdf/dompdf#v1.2.1 https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/ http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-28368.yaml GHSA-x752-qjv4-c4hc

Affected configurations

Vulners
Node
dompdfdompdfRange<1.2.1
CPENameOperatorVersion
dompdf/dompdflt1.2.1

Related

cve 1
prion 1
nvd 1
github 1
zdt 1
ubuntucve 1
cvelist 1
debiancve 1
osv 2
githubexploit 2
packetstorm 1
veracode 1
exploitdb 1
cve
cve
CVE-2022-28368
2022-04-03 03:15:08
prion
prion
Input validation
2022-04-03 03:15:00
nvd
nvd
CVE-2022-28368
2022-04-03 03:15:08
github
github
Remote code injection in dompdf/dompdf
2022-04-04 00:00:55
zdt
zdt
Dompdf 1.2.1 - Remote Code Execution Exploit
2023-04-06 00:00:00
ubuntucve
ubuntucve
CVE-2022-28368
2022-04-03 00:00:00
cvelist
cvelist
CVE-2022-28368
2022-04-03 00:00:00
debiancve
debiancve
CVE-2022-28368
2022-04-03 03:15:08
osv
osv
CVE-2022-28368
2022-04-03 03:15:08
Remote code injection in dompdf/dompdf
2022-04-04 00:00:55
githubexploit
githubexploit
Exploit for Cross-site Scripting in Dompdf Project Dompdf
2023-02-13 08:10:00
Exploit for Cross-site Scripting in Dompdf Project Dompdf
2023-04-28 09:49:05
packetstorm
packetstorm
Dompdf 1.2.1 Remote Code Execution
2023-04-06 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2022-04-04 07:50:43
exploitdb
exploitdb
Dompdf 1.2.1 - Remote Code Execution (RCE)
2023-04-06 00:00:00

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.161 Low

EPSS

Percentile

96.0%

JSON
Related for FRIENDSOFPHP:DOMPDF:DOMPDF:CVE-2022-28368
cve1prion1nvd1github1zdt1ubuntucve1cvelist1debiancve1osv2githubexploit2packetstorm1veracode1exploitdb1