CVE-2024-28184: kozea weasyprint +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-28184

CVSS 7.4 · High EPSS 0,74%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada kozea weasyprint, fedoraproject fedora. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Rincian

Terbit di NVD: 9 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.4 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-829: Inclusion of Functionality from Untrusted Control Sphere
EPSS (30 hari): 0,74% peluang dieksploitasi; lebih tinggi dari 53,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
kozea	weasyprint	Versi 61.0 hingga sebelum 61.2
fedoraproject	fedora	Versi 40

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r advisory vendor
https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598 patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43... mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.