Workaround
An alternative is using either or both --chromium-deny-list and --chromium-allow-list flags.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | github.com/gotenberg/gotenberg/v8/pkg/gotenberg | affected |
|
||||||
| n/a | github.com/gotenberg/gotenberg/v8/pkg/modules/chromium | affected |
|
||||||
| n/a | github.com/gotenberg/gotenberg/v8/pkg/modules/webhook | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-19196 | Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when a request is made to a file via localhost, such as <iframe src="\\localhost/etc/passwd">. By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read on the host system. Workaround An alternative is using either or both --chromium-deny-list and --chromium-allow-list flags. |
No history.
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: snyk
Published:
Updated: 2024-09-05T13:26:11.327Z
Reserved: 2023-12-22T12:33:20.122Z
Link: CVE-2024-21527
Vulnrichment
Updated: 2024-08-01T22:27:34.824Z
NVD
Status : Deferred
Published: 2024-07-19T05:15:10.053
Modified: 2026-04-15T00:35:42.020
Link: CVE-2024-21527
Redhat
No data.
OpenCVE Enrichment
No data.