{"id":"CVE-2020-15231","aliases":["EUVD-2020-0574","GHSA-w534-q4xf-h5v2"],"status":"published","title":"Cross-site scripting attack in mapfish-print","description":"In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00801,"percentile":0.57123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-07-07T16:32:49Z","modified":"2026-10-20T10:51:54Z","fixes":[{"ecosystem":"Maven","package":"org.mapfish.print:print-lib","fixed_in":["3.24"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.mapfish.print:print-servlet","fixed_in":["3.24"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.mapfish.print:print-standalone","fixed_in":["3.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-standalone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24"}]}],"versions":["1.2.0","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","3.0","3.1.0","3.1.1","3.1.2","3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.8","3.11.0","3.11.1","3.11.2","3.11.3","3.12.0","3.12.1","3.13.0","3.14.0","3.14.1","3.15.0","3.16.0","3.16.1","3.16.2","3.17.0","3.18.0","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.2.0","3.20.0","3.20.1","3.20.2","3.20.3","3.21.0","3.22.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24"}]}],"versions":["1.2.0","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","3.0","3.1.0","3.1.1","3.1.2","3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.8","3.11.0","3.11.1","3.11.2","3.11.3","3.12.0","3.12.1","3.13.0","3.14.0","3.14.1","3.15.0","3.16.0","3.16.1","3.16.2","3.17.0","3.18.0","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.2.0","3.20.0","3.20.1","3.20.2","3.20.3","3.21.0","3.22.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-standalone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24"}]}],"versions":["1.2.0","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","3.18.3","3.18.4","3.19.0","3.20.0","3.20.1","3.20.2","3.20.3","3.21.0","3.22.0"]}],"products":[{"vendor":"mapfish","product":"mapfish-print"},{"vendor":"mapfish","product":"print"}],"references":[{"url":"https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15231","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w534-q4xf-h5v2"}],"sources":{"cve":[{"id":"CVE-2020-15231","title":"Cross-site scripting attack in mapfish-print","description":"In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.","status":"published","published":"2020-10-02T19:40:14Z","modified":"2024-08-04T13:08:23.265Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-0574","description":"In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.","status":"published","published":"2020-10-02T19:40:14Z","modified":"2024-08-04T13:08:23Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-w534-q4xf-h5v2","title":"XSS in Mapfish Print relating to JSONP support","description":"### Impact\nA user can use the JSONP support to do a Cross-site scripting.\n\n### Patches\nUse version \u003e= 3.24\n\n### Workarounds\nNo\n\n### References\n* https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e\n* https://cwe.mitre.org/data/definitions/79.html\n\n### For more information\nIf you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397","status":"published","published":"2020-07-07T16:32:49Z","modified":"2023-01-09T05:03:31Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:05.071174Z"}],"nvd":[{"id":"CVE-2020-15231","description":"In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.","status":"published","published":"2020-10-02T20:15:12.567Z","modified":"2026-06-17T02:56:19.26Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-15231","description":"In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.","status":"published","published":"2020-10-02T20:15:12.567Z","modified":"2026-10-20T10:51:54.253750431Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-w534-q4xf-h5v2","title":"XSS in Mapfish Print relating to JSONP support","description":"### Impact\nA user can use the JSONP support to do a Cross-site scripting.\n\n### Patches\nUse version \u003e= 3.24\n\n### Workarounds\nNo\n\n### References\n* https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e\n* https://cwe.mitre.org/data/definitions/79.html\n\n### For more information\nIf you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397","status":"published","published":"2020-07-07T16:32:49Z","modified":"2026-07-08T06:28:48.395570167Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}