CVE-2018-19047
on github
Published
Severity
CVSS v3:
10 CRITICAL
CVSS v2:
7.5 HIGH
Description
mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble.
References
Configurations
| CPE23 | Version Start | Version End | Exact Version |
|---|---|---|---|
| cpe:2.3:a:mpdf_project:mpdf:*:*:*:*:*:*:*:* | n/a | 7.1.6 (including) | * |