PT-2024-8938 · Verapdf · Verapdf
Carlwilson
·
Published
2024-11-03
·
Updated
2024-12-02
·
CVE-2024-52800
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
veraPDF (affected versions not specified)
Description:
The issue is related to the execution of policy checks using custom schematron files via the CLI, which invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This vulnerability is also associated with the incorrect restriction of XML links to external objects in the
mergeEnabledFeaturesFromPolicy() function. The exploitation of this vulnerability may allow a remote attacker to conduct XXE attacks. Most users are not affected as they do not insert custom XSLT code into policy profiles.Recommendations:
For users who insert custom XSLT code into policy profiles, only load custom policy files from sources you trust.
As a temporary workaround, consider restricting the use of custom schematron files until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Verapdf