CVE-2022-28368
Critical
Description
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
SeverityCritical
CVSS9.8
Exploit probability—
ProductDompdf
PublishedApr 3, 2022
First seenApr 3, 2022
How to fix
Update
- dompdf_project dompdf1.2.1 or later
- dompdf/dompdf1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dompdf_project dompdf | v < 1.2.1 | 1.2.1 |
| dompdf/dompdfPackagist | v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.