What is GHSA-3vjh-xrhf-v9xh?

GHSA-3vjh-xrhf-v9xh is a security advisory published by GitHub Security Advisories with Critical severity. Improper Restriction of XML External Entity Reference in dompdf/dompdf

Which CVE IDs does GHSA-3vjh-xrhf-v9xh cover?

GHSA-3vjh-xrhf-v9xh covers the following CVE IDs: CVE-2021-3902. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3vjh-xrhf-v9xh?

GHSA-3vjh-xrhf-v9xh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-3vjh-xrhf-v9xh?

GHSA-3vjh-xrhf-v9xh affects 1 product, including: composer/dompdf/dompdf:\u003c 2.0.0.

GHSA-3vjh-xrhf-v9xhCriticalCVSS 9.8

Improper Restriction of XML External Entity Reference in dompdf/dompdf

Vendor

GitHub Security Advisories

Published

November 15, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2021-3902 →

📋 Description

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

🎯 Affected products1

composer/dompdf/dompdf:< 2.0.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-3902
https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
https://github.com/advisories/GHSA-3vjh-xrhf-v9xh