GHSA-3cwc-m7c2-qr86

Source

https://github.com/advisories/GHSA-3cwc-m7c2-qr86

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3cwc-m7c2-qr86/GHSA-3cwc-m7c2-qr86.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3cwc-m7c2-qr86

Aliases

CVE-2019-1000005

Published

2022-05-14T01:33:54Z

Modified

2024-02-16T08:24:25.552521Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

mPDF Unsafe Deserialization

Details

mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8.

Database specific

{
    "nvd_published_at": "2019-02-04T21:29:00Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-19T21:15:29Z"
}

References

Affected packages

Packagist / mpdf/mpdf

Package

Name: mpdf/mpdf
Purl: pkg:composer/mpdf/mpdf

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.1.8

Affected versions

v5.*

v5.5.1

v5.6.1

v5.7.0

v5.7.1

v5.7.2

v5.7.3a

v5.7.3

v5.7.4a

v5.7.4

v6.*

v6.0-beta

v6.0.0

v6.1.0

v6.1.1

v6.1.2a

v6.1.2

v6.1.3

v6.1.4

v7.*

v7.0.0-beta1

v7.0.0-beta2

v7.0.0-RC1

v7.0.0-RC2

v7.0.0-RC3

v7.0.0-RC4

v7.0.0

v7.0.1

v7.0.3

v7.1.0

v7.1.1

v7.1.2

v7.1.3

v7.1.4

v7.1.5

v7.1.6

v7.1.7

7.*

7.0.2

Database specific

{
    "last_known_affected_version_range": "<= 7.1.7"
}