{"id":"CVE-2020-15232","aliases":["EUVD-2020-0572","GHSA-vjv6-gq77-3mjw"],"status":"published","title":"XML External Entity attack in mapfish-print","description":"In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01342,"percentile":0.71589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2020-07-07T16:32:45Z","modified":"2026-10-20T10:51:54Z","fixes":[{"ecosystem":"Maven","package":"org.mapfish.print:print-lib","fixed_in":["3.24"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.mapfish.print:print-servlet","fixed_in":["3.24"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.mapfish.print:print-standalone","fixed_in":["3.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.24"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.24"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-standalone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.24"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.24"}]}],"versions":["3.0","3.1.0","3.1.1","3.1.2","3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.8","3.11.0","3.11.1","3.11.2","3.11.3","3.12.0","3.12.1","3.13.0","3.14.0","3.14.1","3.15.0","3.16.0","3.16.1","3.16.2","3.17.0","3.18.0","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.2.0","3.20.0","3.20.1","3.20.2","3.20.3","3.21.0","3.22.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.24"}]}],"versions":["3.0","3.1.0","3.1.1","3.1.2","3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.8","3.11.0","3.11.1","3.11.2","3.11.3","3.12.0","3.12.1","3.13.0","3.14.0","3.14.1","3.15.0","3.16.0","3.16.1","3.16.2","3.17.0","3.18.0","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.2.0","3.20.0","3.20.1","3.20.2","3.20.3","3.21.0","3.22.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-standalone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.24"}]}],"versions":["3.18.3","3.18.4","3.19.0","3.20.0","3.20.1","3.20.2","3.20.3","3.21.0","3.22.0"]}],"products":[{"vendor":"mapfish","product":"mapfish-print"},{"vendor":"mapfish","product":"print"}],"references":[{"url":"https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/mapfish/mapfish-print/pull/1397","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15232","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vjv6-gq77-3mjw"},{"url":"https://github.com/mapfish/mapfish-print","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-15232","title":"XML External Entity attack in mapfish-print","description":"In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.","status":"published","published":"2020-10-02T19:45:15Z","modified":"2024-08-04T13:08:22.897Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-0572","description":"In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.","status":"published","published":"2020-10-02T19:45:15Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-vjv6-gq77-3mjw","title":"XXE attack in Mapfish Print","description":"### Impact\nA user can do to an XML External Entity (XXE) attack with the provided SDL style.\n\n### Patches\nUse version \u003e= 3.24\n\n### Workarounds\nNo\n\n### References\n* https://cwe.mitre.org/data/definitions/611.html\n* https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e\n\n### For more information\nIf you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397\n","status":"published","published":"2020-07-07T16:32:45Z","modified":"2023-06-27T20:31:39Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:55.184601Z"}],"nvd":[{"id":"CVE-2020-15232","description":"In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.","status":"published","published":"2020-10-02T20:15:12.66Z","modified":"2026-06-17T02:56:19.36Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-15232","description":"In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.","status":"published","published":"2020-10-02T20:15:12.66Z","modified":"2026-10-20T10:51:54.458048659Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-vjv6-gq77-3mjw","title":"XXE attack in Mapfish Print","description":"### Impact\nA user can do to an XML External Entity (XXE) attack with the provided SDL style.\n\n### Patches\nUse version \u003e= 3.24\n\n### Workarounds\nNo\n\n### References\n* https://cwe.mitre.org/data/definitions/611.html\n* https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e\n\n### For more information\nIf you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397\n","status":"published","published":"2020-07-07T16:32:45Z","modified":"2026-09-10T03:48:48.752810166Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}