Skip to content
OpenAdvisories
Critical · 9.3 CVE-2020-15232 EUVD-2020-0572GHSA-vjv6-gq77-3mjw

XML External Entity attack in mapfish-print

Published Oct 2, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: mapfish Product: mapfish-print Package: org.mapfish.print:print-lib Package: org.mapfish.print:print-servlet Package: org.mapfish.print:print-standalone Ecosystem: Maven

Description

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Affected products

VendorProductAffectedFixed
mapfish mapfish-print < 3.24 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.mapfish.print:print-lib >= 3.0, < 3.24 3.24 GHSA-vjv6-gq77-3mjw
Maven org.mapfish.print:print-servlet >= 3.0, < 3.24 3.24 GHSA-vjv6-gq77-3mjw
Maven org.mapfish.print:print-standalone >= 3.0, < 3.24 3.24 GHSA-vjv6-gq77-3mjw

References