cve.bz

CVE-2020-11988

8.2 highEPSS 6.7%

High (8.2). EPSS 6.7% chance of exploitation in the next 30 days. Fixed in org.apache.xmlgraphics:xmlgraphics-commons 2.6.

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

Severity

CVSS 3.1

8.2 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS
6.7% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWEs
CWE-20, CWE-918
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-fmj2-7wx8-qj4vMavenorg.apache.xmlgraphics:xmlgraphics-commons<2.62.6

References

Check your stackJSON