CVE-2022-28368

Published: Apr 3, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/dompdf/dompdf/issues/2598

https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/

https://github.com/snyk-labs/php-goof

https://packagist.org/packages/dompdf/dompdf#v1.2.1

https://github.com/dompdf/dompdf/pull/2808

https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d

http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2022-28368

Description

Affected Products

References