CVE-2021-3902: Improper Restriction of XML External Entity Reference in dompdf/dompdf
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3902?
CVE-2021-3902 has a medium severity rating due to its potential for exploitation through SSRF and deserialization attacks.
How do I fix CVE-2021-3902?
To fix CVE-2021-3902, upgrade to dompdf version 2.0.0 or higher.
What does CVE-2021-3902 vulnerability affect?
CVE-2021-3902 affects all versions of dompdf prior to 2.0.0.
Can CVE-2021-3902 be exploited if remote access is disabled?
Yes, CVE-2021-3902 can be exploited regardless of whether the isRemoteEnabled option is set to true or false.
What type of attacks can CVE-2021-3902 facilitate?
CVE-2021-3902 can facilitate Server-Side Request Forgery (SSRF) and deserialization attacks.