CVE-2020-11988
High
Description
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
SeverityHigh
CVSS8.2
Exploit probability—
Product
Apache Xmlgraphics Commons
PublishedFeb 24, 2021
First seenFeb 24, 2021
How to fix
Update
- org.apache.xmlgraphics:xmlgraphics-commons2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache xmlgraphics_commons | v ≤ 2.4 | — |
| fedoraproject fedora | 33, 34 | — |
| org.apache.xmlgraphics:xmlgraphics-commonsMaven | v < 2.6 | 2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.