GitHub Advisoryadvisory · Maven

GHSA-w534-q4xf-h5v2 XSS in Mapfish Print relating to JSONP support

LOW Published 2020-07-07 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-15231
Ecosystem
Maven
Packages
org.mapfish.print:print-lib, org.mapfish.print:print-servlet, org.mapfish.print:print-standalone
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-07-07

Affected packages

• Maven org.mapfish.print:print-lib: < 3.24 → fixed in 3.24 • Maven org.mapfish.print:print-servlet: < 3.24 → fixed in 3.24 • Maven org.mapfish.print:print-standalone: < 3.24 → fixed in 3.24

Description

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version >= 3.24 Workarounds No References • https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e • https://cwe.mitre.org/data/definitions/79.html For more information If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

Related

Alias · CVE (1)

  • CVE-2020-15231 In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References