CVE-2024-28109

HIGH

veraPDF-library < 1.24.2 - Remote Code Execution via Custom Schematron XSL Transformation

Title source: llm
STIX 2.1

Description

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

References (5)

Core 5

Scores

CVSS v3 8.1
EPSS 0.0103
EPSS Percentile 59.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-91
Status published
Products (10)
org.verapdf/core 0 - 1.24.2Maven
org.verapdf/core-arlington 0 - 1.25.127Maven
org.verapdf/core-jakarta 0 - 1.24.2Maven
org.verapdf/library 0 - 1.24.2Maven
org.verapdf/library-arlington 0 - 1.25.127Maven
org.verapdf/library-jakarta 0 - 1.24.2Maven
org.verapdf/verapdf-library 0 - 1.24.2Maven
org.verapdf/verapdf-library-arlington 0 - 1.25.127Maven
org.verapdf/verapdf-library-jakarta 0 - 1.24.2Maven
veraPDF/veraPDF-library < 1.24.2
Published Mar 28, 2024
Tracked Since Feb 18, 2026