CVE-2014-5013

high-risk

Published 2020-01-10

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.

Do I need to act?

25.6% chance of exploitation in next 30 days

EPSS score — higher than 74% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Dompdf

Dompdf Project

Third Party Advisory https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2

Release Notes https://github.com/dompdf/dompdf/releases/tag/v0.6.2

Third Party Advisory https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2

Release Notes https://github.com/dompdf/dompdf/releases/tag/v0.6.2

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 15/34 · Moderate

Exposure 5/34 · Minimal