CVE-2020-15231

Cross-site scripting attack in mapfish-print

9.3 CriticalFix available

CVE-2020-15231 is a critical vulnerability (CVSS 9.3) in Mapfish Mapfish-print, published July 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in org.mapfish.print:print-lib 3.24.

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.80%Up 0.2 points since Apr 14, 2021

What each source reports

CVE List Score used 9.3

Cross-site scripting attack in mapfish-print

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Record: CVE-2020-15231
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2020-0574 9.3

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Record: EUVD-2020-0574
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w534-q4xf-h5v2 9.3

XSS in Mapfish Print relating to JSONP support

Impact

A user can use the JSONP support to do a Cross-site scripting.

Patches

Use version >= 3.24

Workarounds

References

For more information

If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

Record: GHSA-w534-q4xf-h5v2
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 9.3

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Record: CVE-2020-15231
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Record: CVE-2020-15231
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-w534-q4xf-h5v2 9.3

XSS in Mapfish Print relating to JSONP support

Impact

A user can use the JSONP support to do a Cross-site scripting.

Patches

Use version >= 3.24

Workarounds

References

For more information

If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

Record: GHSA-w534-q4xf-h5v2
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.mapfish.print:print-lib` Maven	before 3.24	3.24
`org.mapfish.print:print-servlet` Maven	before 3.24	3.24
`org.mapfish.print:print-standalone` Maven	before 3.24	3.24
`org.mapfish.print:print-lib` Maven	before 3.24, plus listed versions 1.2.02.0.02.1.02.1.12.1.2 Show 45 moreShow less 2.1.32.1.42.1.53.03.1.03.1.13.1.23.10.03.10.13.10.23.10.33.10.43.10.53.10.63.10.73.10.83.11.03.11.13.11.23.11.33.12.03.12.13.13.03.14.03.14.13.15.03.16.03.16.13.16.23.17.03.18.03.18.13.18.23.18.33.18.43.19.03.2.03.20.03.20.13.20.23.20.33.21.03.22.03.3.03.4.0	3.24
`org.mapfish.print:print-servlet` Maven	before 3.24, plus listed versions 1.2.02.0.02.1.02.1.12.1.2 Show 45 moreShow less 2.1.32.1.42.1.53.03.1.03.1.13.1.23.10.03.10.13.10.23.10.33.10.43.10.53.10.63.10.73.10.83.11.03.11.13.11.23.11.33.12.03.12.13.13.03.14.03.14.13.15.03.16.03.16.13.16.23.17.03.18.03.18.13.18.23.18.33.18.43.19.03.2.03.20.03.20.13.20.23.20.33.21.03.22.03.3.03.4.0	3.24
`org.mapfish.print:print-standalone` Maven	before 3.24, plus listed versions 1.2.02.0.02.1.02.1.12.1.2 Show 12 moreShow less 2.1.32.1.42.1.53.18.33.18.43.19.03.20.03.20.13.20.23.20.33.21.03.22.0	3.24

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 10 versions. The JSON record has them.