CVE-2024-9075: Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
First published: Sat Sep 21 2024(Updated: )
A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. It has been declared as problematic. This vulnerability affects unknown code of the component Markdown-to-PDF. The manipulation leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.29.0 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains that "this functionality was removed in 0.29.0 already" and "we plan to re-add at later date with issue resolved".
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Stirling Pdf | <0.29.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9075?
CVE-2024-9075 has been declared as a problematic vulnerability affecting Stirling-PDF.
How does CVE-2024-9075 affect Stirling-PDF?
CVE-2024-9075 affects the Markdown-to-PDF component, leading to potential cross site scripting vulnerabilities.
How can the CVE-2024-9075 vulnerability be exploited?
The vulnerability CVE-2024-9075 can be exploited remotely by manipulating affected code.
What versions of Stirling-PDF are affected by CVE-2024-9075?
CVE-2024-9075 impacts Stirling-PDF versions up to and including 0.28.3, but not 0.29.0 or later.
How do I mitigate CVE-2024-9075?
To mitigate CVE-2024-9075, upgrade Stirling-PDF to version 0.29.0 or later.
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/stirlingpdf
- canonical/stirling pdf