TCPDF Error Handling Vulnerability in Popular PDF Library
CVE-2024-56527

7.5HIGH

Key Information:

Vendor

Tecnick

Status
TcPDF
Vendor
CVE Published:
27 December 2024

What is CVE-2024-56527?

An identified issue in TCPDF versions prior to 6.8.0 pertains to insufficient sanitization of error messages within the Error function. Specifically, the lack of an htmlspecialchars call can leave applications utilizing this PDF generation library vulnerable to potential cross-site scripting (XSS) attacks. This vulnerability underscores the importance of implementing robust error handling mechanisms and input sanitization to protect against injection attacks. The issue has been resolved in version 6.8.0, reinforcing the need for users to update to the latest release to secure their applications.

Affected Version(s)

tcpdf 0 < 6.8.0

References

https://tcpdf.org
https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0
https://github.com/tecnickcom/TCPDF/commit/11778aaa2d9e30...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.