CVE-2020-15232 XML External Entity attack in mapfish-print

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

CVE-2020-15232

The CVE-2020-15232 issue affects mapfish-print prior to version 3.24, where XML External Entity (XXE) processing is vulnerable via the SDL parser (DTDs are not disabled), enabling an attacker to inject untrusted entities. Public advisories describe remote XXE exploitation, with remediation statin...

CVE-2020-15231

CVE-2020-15231 affects mapfish-print prior to version 3.24. A JSONP misuse in mapfish-print allows Cross-site Scripting, enabling an attacker to inject and execute arbitrary JavaScript in a user’s browser via JSONP. Remediation per advisories is to upgrade to version 3.24 or later. The connected ...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15231: Improper Neutralization of Input During Web Page Generation

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15232: Improper Restriction of XML External Entity Reference

In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...

XML External Entity (XXE)

mapfish-print is vulnerable to XML External Entity XXE. The vulnerability exists as the disallow-doctype-decl feature was not set in the removeIndexReference method used in SLDParserPlugin...

GHSA-W534-Q4XF-H5V2 XSS in Mapfish Print relating to JSONP support

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version = 3.24 Workarounds No References https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e https://cwe.mitre.org/data/definitions/79.html For more information If you...

XSS in Mapfish Print relating to JSONP support

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version = 3.24 Workarounds No References https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e https://cwe.mitre.org/data/definitions/79.html For more information If you...

GHSA-VJV6-GQ77-3MJW XXE attack in Mapfish Print

Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...

XXE attack in Mapfish Print

Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...

PT-2020-14297

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.24 Description The issue allows a user to perform a Cross-site scripting attack using the JSONP support. Recommendations For versions prior to 3.24, use version 3.24 or later to resolve the issue. As a tempora...

PT-2020-14298

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.24 Description The issue allows a user to perform an XML External Entity XXE attack using the provided SDL style. This can be exploited by manipulating the XML input to access unauthorized data or disrupt...