CVE-2024-52800
Vulnerability Scoring
Attack Complexity Details
- Attack Complexity: Analysis in progress
- Attack Vector: Analysis in progress
- Privileges Required: Analysis in progress
CIA Impact Definition
- Confidentiality:
- Integrity:
- Availability:
CVE-2024-52800 Vulnerability Summary
veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.
Need help fixing CVEs? Check out our Step-by-Step Guide on How to Fix CVEs.
Access Complexity Graph for CVE-2024-52800
Impact Analysis for CVE-2024-52800
CVE-2024-52800: Detailed Information and External References
EPSS
0.00043
EPSS %
0.10929
References
0.00043
- https://github.com/veraPDF/veraPDF-library/issues/1488
- https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
CWE
CWE-611
CAPEC
0.00043
- Data Serialization External Entities Blowup: This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
Protect Your Infrastructure: Combat Critical CVE Threats
Stay updated with real-time CVE vulnerabilities and take action to secure your systems. Enhance your cybersecurity posture with the latest threat intelligence and mitigation techniques. Develop the skills necessary to defend against CVEs and secure critical infrastructures. Join the top cybersecurity professionals safeguarding today's infrastructures.