CVE Feed

    Dashboard / CVE / CVE-2022-35583

    CVE-2022-35583

    wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.

    Published:Aug 22, 2022
    Last Modified:Mar 18, 2025
    EPS:Aug 22, 2022
    EPSS Score:0.60642
    CVSS Score:9.8

    Affected Products

    Vendor
    Wkhtmltopdf
    Product
    Wkhtmltopdf

    Exploits

    http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.htmlhttps://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharinghttp://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.htmlhttps://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharinghttps://www.exploit-db.com/exploits/51039

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High