CVE-2021-3902 - CVE House
Back to Database
Status published Critical CVE-2021-3902

Improper Restriction of XML External Entity Reference in dompdf/dompdf

Vulnerability Description

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-3902

Credits & Attribution

No credits recorded in the NVD database.

References

More from dompdf

View All →
CVE-2024-25117
php-svg-lib lacks path validation on font through SVG inline styles
Medium 6.8
CVE-2023-50262
Dompdf possible DoS caused by infinite recursion when parsing SVG images
Medium 5.3
CVE-2023-50252
php-svg-lib unsafe attributes merge when parsing `use` tag
High 8.3
CVE-2023-50251
php-svg-lib possible DoS caused by infinite recursion when parsing SVG document
Medium 5.3
CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
Critical 10

Affected Vendor

Affected Software

dompdf/dompdf
Vulnerable Versions:
unspecified

Timeline

Official Publish: November 15th, 2024
Last Modified: November 18th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-611

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1040 Network Sniffing
Collection
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact