CVE-2024-32489: 
PHP vulnerability analysis and mitigation

TCPDF before version 6.7.4 contains a security vulnerability related to mishandling calls that use HTML syntax. The vulnerability was disclosed on April 15, 2024, affecting the TCPDF library, which is used for generating PDF documents (NVD, MITRE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) (NVD).

The vulnerability could potentially allow attackers to exploit HTML syntax handling issues in TCPDF, leading to possible security implications when processing HTML content (DEBIAN).

The vulnerability requires user interaction and can be exploited remotely without requiring privileges. The attack complexity is considered low, making it relatively straightforward to exploit under the right conditions (NVD).

The vulnerability has been fixed in TCPDF version 6.7.4. Users are advised to upgrade to this version or later. The fix includes changes to the TCPDF HTML tag syntax and introduces a new K_ALLOWED_TCPDF_TAGS configuration constant to set the allowed methods for the TCPDF HTML tag (TCPDF Commit).