Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2014-2383

CVE-2014-2383:
DOMPDF Arbitrary File Read

6.8

CVSS Score

Basic Information

CVE ID
CVE-2014-2383
GHSA ID
GHSA-qr6q-w4gj-3865
EPSS Score
-
CWE
CWE-200
Published
5/14/2022
Updated
4/25/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
AV:N/AC:M/Au:N/C:P/I:P/A:P
Package NameEcosystemVulnerable VersionsFirst Patched Version
dompdf/dompdfcomposer>= 0.6.0, < 0.6.10.6.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis focused on the changes made in the patch to identify vulnerable functions. The removal of code that evaluates PHP in the load_html function directly points to its vulnerability. The change in dompdf.php related to disallowing php:// streams also indicates a vulnerability in how input files are processed, but the exact function name is not specified in the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*omp**.p*p in *omp** ***or* *.*.*, w**n `*OMP**_*N**L*_P*P` is *n**l**, *llows *ont*xt-**p*n**nt *tt**k*rs to *yp*ss **root prot**tions *n* r*** *r*itr*ry *il*s vi* * P*P proto*ol *n* wr*pp*rs in t** input_*il* p*r*m*t*r, *s **monstr*t** *y * `p*p://

Reasoning

T** *n*lysis *o*us** on t** ***n**s m*** in t** p*t** to i**nti*y vuln*r**l* *un*tions. T** r*mov*l o* *o** t**t *v*lu*t*s P*P in t** lo**_*tml *un*tion *ir**tly points to its vuln*r**ility. T** ***n** in *omp**.p*p r*l*t** to *is*llowin* p*p:// str*