TCPDF Cross-site Scripting vulnerability in tecnickcom/tcpdf
Summary
CVE-2024-32489: TCPDF Cross-site Scripting vulnerability. Affects tecnickcom/tcpdf versions < 6.7.4. Fixed in 6.7.4. How to fix ↓
Also tracked for
- tcpdf · Debian:11
The same CVE-2024-32489 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TCPDF is a popular open-source PHP library for generating PDF documents. It provides a wide range of functionality for creating and manipulating PDF files. However, versions prior to 6.7.4 are vulnerable to a Cross-site Scripting (XSS) attack. This vulnerability arises from mishandling calls that use HTML syntax.
Vulnerability Detail
The TCPDF library, before version 6.7.4, does not properly sanitize user input, allowing an attacker to inject malicious code into generated PDF documents. This can lead to Cross-site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript code in the context of a victim's browser. This vulnerability has a moderate severity rating (CWE-79) and can potentially result in unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
6.7.4
This is the first release that contains the fix.
composer require tecnickcom/tcpdf:6.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The TCPDF library, before version 6.7.4, is vulnerable to a Cross-site Scripting (XSS) attack. To mitigate this vulnerability, it is crucial to upgrade to TCPDF version 6.7.4 or later. This upgrade includes proper input sanitization to prevent XSS attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tecnickcom/tcpdf →
FAQ
TCPDF is a PHP library for generating PDF documents.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of a victim's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, you should upgrade to TCPDF version 6.7.4 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of TCPDF.
References
Related vulnerabilities
Recent vulnerabilities recorded for tecnickcom/tcpdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
