CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCVE-2020-15232
In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mapfish:print
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vjv6-gq77-3mjw | Maven | org.mapfish.print:print-lib | >=3.0 <3.24 | 3.24 |
| GHSA-vjv6-gq77-3mjw | Maven | org.mapfish.print:print-servlet | >=3.0 <3.24 | 3.24 |
| GHSA-vjv6-gq77-3mjw | Maven | org.mapfish.print:print-standalone | >=3.0 <3.24 | 3.24 |
References
- https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e
- https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw
- https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e
- https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw