Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-28109

Good to know:

icon
icon

Date: March 28, 2024

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

Language: Java

Severity Score

Related Resources (8)

https://github.com/veraPDF/veraPDF-library
https://github.com/veraPDF/veraPDF-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb
https://github.com/veraPDF/veraPDF-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe
https://nvd.nist.gov/vuln/detail/CVE-2024-28109
https://github.com/veraPDF/veraPDF-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-qxqf-2mfx-x8jw
https://github.com/veraPDF/veraPDF-library/issues/1415
https://www.mend.io/vulnerability-database/CVE-2024-28109

Severity Score

Weakness Type (CWE)

XML Injection (aka Blind XPath Injection)

CWE-91

Top Fix

icon

Upgrade Version

Upgrade to version org.verapdf:core:1.24.2, org.verapdf:core-jakarta:1.24.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us