CVE Feed

    Dashboard / CVE / CVE-2022-0085

    CVE-2022-0085

    Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.

    Published:Jun 28, 2022
    Last Modified:Nov 21, 2024
    EPS:Jun 28, 2022
    EPSS Score:0.00674
    CVSS Score:5.3

    Affected Products

    Vendor
    Dompdf Project
    Product
    Dompdf

    Exploits

    https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2021-3902 (CVSS 9.8) — An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Serv…
    CVE-2021-3838 (CVSS 9.8) — DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol be…
    CVE-2023-50262 (CVSS 5.3) — Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to e…
    CVE-2023-24813 (CVSS 10) — Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
    CVE-2023-23924 (CVSS 10) — Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passi…
    CVE-2022-41343 (CVSS 7.5) — registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation f…
    CVE-2022-2400 (CVSS 5.3) — External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.…
    CVE-2022-28368 (CVSS 9.8) — Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Styl…
    CVE-2014-5011 (CVSS 6.5) — DOMPDF before 0.6.2 allows Information Disclosure.…
    CVE-2014-5012 (CVSS 6.5) — DOMPDF before 0.6.2 allows denial of service.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High