Debian Security Bug TrackerDEBIANCVE:CVE-2022-35583CVE-2022-35583
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.025 Low
EPSS
Percentile
90.2%
wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target’s system by injecting iframe tag with initial asset IP address on it’s source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | wkhtmltopdf | <= 0.12.6-2 | wkhtmltopdf_0.12.6-2_all.deb |
| Debian | 11 | all | wkhtmltopdf | <= 0.12.6-1 | wkhtmltopdf_0.12.6-1_all.deb |
| Debian | 10 | all | wkhtmltopdf | <= 0.12.5-1 | wkhtmltopdf_0.12.5-1_all.deb |
| Debian | 999 | all | wkhtmltopdf | <= 0.12.6-2 | wkhtmltopdf_0.12.6-2_all.deb |
| Debian | 13 | all | wkhtmltopdf | <= 0.12.6-2 | wkhtmltopdf_0.12.6-2_all.deb |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.025 Low
EPSS
Percentile
90.2%