CVE-2022-35583

Katalog CVE

CVSS 9.8 · Critical EPSS 15,4%

Kerentanan Server-Side Request Forgery (SSRF) pada wkhtmltopdf. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.

Rincian

Terbit di NVD

22 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

15,4% peluang dieksploitasi; lebih tinggi dari 96,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wkhtmltopdf.org/ product · advisory vendor
• https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing exploit · advisory pihak ketiga
• http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html exploit
• https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently url repurposed