CVE-2024-25180

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada pdfmake project pdfmake. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.

Rincian

Terbit di NVD

29 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-6347243 exploit · advisory pihak ketiga
• https://www.youtube.com/watch?v=QcOlrWUGo6o exploit
• https://github.com/bpampuch/pdfmake/issues/2702 issue tracking
• https://github.com/joaoviictorti/My-CVES/blob/main/CVE-2024-25180/README.md broken link