GitHub Advisoryadvisory · Maven

GHSA-fmj2-7wx8-qj4v Server-side request forgery (SSRF) in Apache XmlGraphics Commons

HIGH Published 2022-02-09 Modified 2022-01-06 Official page ↗
Aliases
CVE-2020-11988
Ecosystem
Maven
Packages
org.apache.xmlgraphics:xmlgraphics-commons
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-20, CWE-918
Reviewed
2021-03-31

Affected packages

• Maven org.apache.xmlgraphics:xmlgraphics-commons: < 2.6 → fixed in 2.6

Description

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Related

Alias · CVE (1)

  • CVE-2020-11988 Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-918 Server-Side Request Forgery weakness

References