CVE-2018-19047

2018-11-0705:00:00

mitre

github.com

6.8 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.1%

JSON

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a ‘<img src="http://192.168’ substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating">

References

github.com/mpdf/mpdf/issues/867