Skip to main content

Improper Input Validation

CVE-2024-21549

Medium
6.6/10

Summary

The package spatie/browsershot versions prior to 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the "setUrl" method. An attacker can exploit this vulnerability by utilizing "view-source:file://", which allows for arbitrary file reading on a local file. Note: This is a bypass of the fix for CVE-2024-21544.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published