GitHub Advisoryadvisory · Maven

GHSA-vjv6-gq77-3mjw XXE attack in Mapfish Print

CRITICAL Published 2020-07-07 Modified 2023-06-27 Official page ↗
Aliases
CVE-2020-15232
Ecosystem
Maven
Packages
org.mapfish.print:print-lib, org.mapfish.print:print-servlet, org.mapfish.print:print-standalone
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-611
Reviewed
2020-07-07

Affected packages

• Maven org.mapfish.print:print-lib: >= 3.0, < 3.24 → fixed in 3.24 • Maven org.mapfish.print:print-servlet: >= 3.0, < 3.24 → fixed in 3.24 • Maven org.mapfish.print:print-standalone: >= 3.0, < 3.24 → fixed in 3.24

Description

Impact A user can do to an XML External Entity (XXE) attack with the provided SDL style. Patches Use version >= 3.24 Workarounds No References • https://cwe.mitre.org/data/definitions/611.html • https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more information If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

Related

Alias · CVE (1)

  • CVE-2020-15232 In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References