CVE-2014-2383

 

Published at: - 28-04-2014 04:09

Last modified: - 26-01-2023 04:59

Total changes: - 2

Description

dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:P/I:P/A:P

 

Verification logic

 

Reference

• 20140423 CVE-2014-2383 - Arbitrary file read in dompdf-Mailing List, Third Party Advisory
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/
• https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028
• 20140423 CVE-2014-2383 - Arbitrary file read in dompdf-Broken Link, Third Party Advisory, VDB Entry

 

Keywords

NVD

 

CVE-2014-2383

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures