Published: 24/02/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 8.2 | Impact Score: 4.2 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Apache XmlGraphics Commons 2.4 and previous versions is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache xmlgraphics commons
fedoraproject fedora 33
fedoraproject fedora 34

Debian Bug report logs - #984949 xmlgraphics-commons: CVE-2020-11988: SSRF due to improper input validation by the XMPParser Package: src:xmlgraphics-commons; Maintainer for src:xmlgraphics-commons is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianor ...

Apache XmlGraphics Commons 24 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests Users should upgrade to 26 or later (CVE-2020-11988) ...

Apache XmlGraphics Commons 24 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests ...

The Apache XML Graphics Commons library before version 26 is vulnerable to server-side request forgery (SSRF) via the XMPParser that allow an attacker to cause the underlying server to make arbitrary GET requests ...

CWE-20 CWE-918 https://xmlgraphics.apache.org/security.html https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuoct2021.html https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E https://lists.apache.org/thread.html/ra8f4d6ae402ec020ee3e8c28632c91be131c4d8b4c9c6756a179b12b%40%3Cdev.jmeter.apache.org%3E https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JP4XA56DA3BFNRBBLBXM6ZAI5RUVFA33/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22HESSYU7T4D6GGENUVEX3X3H6FGBECH/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984949 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2024-2411.html

CVE-2020-11988

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect