CVE-2020-15232

CRITICAL

mapfish/print < 3.24 - XML External Entity Injection via SDL Style

Title source: llm

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Core 2

Core References

Third Party Advisory x_refsource_confirm

Patch, Third Party Advisory x_refsource_misc

CVSS v3 9.3

EPSS 0.0133

EPSS Percentile 67.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-611

Status published

Products (4)

mapfish/print < 3.24

org.mapfish.print/print-lib 3.0 - 3.24Maven

org.mapfish.print/print-servlet 3.0 - 3.24Maven

org.mapfish.print/print-standalone 3.0 - 3.24Maven

Published Oct 02, 2020

Tracked Since Feb 18, 2026