CVE-2020-11988: Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Summary
CVE-2020-11988: Server-side request forgery (SSRF) in Apache XmlGraphics Commons. Affects org.apache.xmlgraphics:xmlgraphics-commons versions < 2.6. Fixed in 2.6. How to fix ↓
Also tracked for
- xmlgraphics-commons · Debian:11
The same CVE-2020-11988 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache XmlGraphics Commons is a library that provides functionality for working with XML-based graphics formats. It is commonly used in applications that require parsing and manipulating XML files related to graphics. This vulnerability affects version 2.4 of the library. The library is vulnerable to server-side request forgery (SSRF), which occurs due to improper input validation by the XMPParser. An attacker can exploit this vulnerability by providing a specially-crafted argument, leading to arbitrary GET requests being made by the underlying server.
Vulnerability Detail
The server-side request forgery (SSRF) vulnerability in Apache XmlGraphics Commons 2.4 allows an attacker to manipulate the server's behavior and make arbitrary GET requests. This can lead to unauthorized access to internal resources, information disclosure, or further attacks against other systems. The vulnerability arises from the lack of proper input validation in the XMPParser component of the library. By exploiting this vulnerability, an attacker can trick the server into making requests to unintended targets, potentially bypassing security measures and gaining unauthorized access to sensitive information.
How To Fix
Latest published version: 2.12 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a patched version of Apache XmlGraphics Commons.
Conclusion
Apache XmlGraphics Commons version 2.4 is vulnerable to a server-side request forgery (SSRF) vulnerability. This can be exploited by an attacker to make arbitrary GET requests and potentially gain unauthorized access to internal resources. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the library (2.6 or later) and ensure proper input validation and sanitization in applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:xmlgraphics-commons →
FAQ
Apache XmlGraphics Commons is a library that provides functionality for working with XML-based graphics formats. It is commonly used in applications that require parsing and manipulating XML files related to graphics.
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to manipulate the server's behavior and make arbitrary requests to internal or external resources. In this case, the vulnerability in Apache XmlGraphics Commons allows an attacker to trick the server into making unintended GET requests.
This vulnerability can lead to unauthorized access to internal resources, information disclosure, or further attacks against other systems. It can be used by an attacker to bypass security measures and gain unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache XmlGraphics Commons (version 2.6 or later). Developers should update their project's dependencies to use the fixed version of the library.
No, there is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a patched version of Apache XmlGraphics Commons.
