CVE-2020-15232: XXE attack in Mapfish Print
Summary
CVE-2020-15232: XXE attack in Mapfish Print. Affects org.mapfish.print:print-lib versions >= 3.0, < 3.24. Fixed in 3.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mapfish Print is an open-source Java library and standalone server for generating printable maps. It provides a RESTful API for creating map images, PDFs, and SVGs. The library is widely used in various applications for generating printable maps. However, it is vulnerable to an XML External Entity (XXE) attack when processing SDL styles.
Vulnerability Detail
The vulnerability allows an attacker to perform an XML External Entity (XXE) attack by exploiting the SDL style provided. This can lead to various security issues, including information disclosure, server-side request forgery (SSRF), and remote code execution. The vulnerability has a CVSS score of 9.3, indicating a critical severity level.
How To Fix
Minimum fixed version
3.24
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version to ensure the security of the application.
Conclusion
The XXE vulnerability in Mapfish Print can have severe security implications, including information disclosure and remote code execution. It is recommended to update to version 3.24 or above of the affected packages to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.mapfish.print:print-lib →
FAQ
Mapfish Print is an open-source Java library and standalone server for generating printable maps.
An XML External Entity (XXE) attack is a type of attack that exploits the processing of XML input containing external entity references. It can lead to various security issues, including information disclosure and remote code execution.
The vulnerability allows an attacker to perform an XXE attack, which can lead to information disclosure, server-side request forgery (SSRF), and remote code execution.
To fix the vulnerability, update to version 3.24 or above of the affected packages: org.mapfish.print:print-lib, org.mapfish.print:print-servlet, and org.mapfish.print:print-standalone.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.mapfish.print:print-lib.
