CVE-2024-28109highCWE-91

CVE-2024-28109: high-severity vulnerability in veraPDF-library

Potential XSLT injection vulnerability when using policy files

Published · Updated

Follow this CVE+ Monitor veraPDF-library+ Monitor org.verapdf:core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.0%
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
veraPDF · veraPDF-library
Related CVEs — veraPDF-library

In the same product, most dangerous first.

CVE-2024-52800LOWPotential XXE (XML External Entity Injection) vulnerability in veraPDF CLIEPSS 1.1%