XSS in Mapfish Print relating to JSONP support

MEDIUM 6.1CVE-2020-15231 · GHSA-w534-q4xf-h5v2 · Published 02/10/2020 · updated 17/06/2026

In short

CVE-2020-15231 is a MEDIUM (CVSS 6.1) vulnerability affecting org.mapfish.print:print-lib, org.mapfish.print:print-servlet, org.mapfish.print:print-standalone.
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.6% of all vulnerabilities.
Fix: update to 3.24 or later.

Package	Affected versions	Patched versions
org.mapfish.print:print-lib Maven	`< 3.24`	`3.24`
org.mapfish.print:print-servlet Maven	`< 3.24`	`3.24`
org.mapfish.print:print-standalone Maven	`< 3.24`	`3.24`
print mapfish	`< 3.24`	`3.24`

A user can use the JSONP support to do a Cross-site scripting.

Use version >= 3.24

If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

NVD description

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

< 3.24

3.24

Maven

< 3.24

3.24

Maven

< 3.24

3.24

< 3.24

3.24

Description

NVD description

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

More vulnerabilities in org.mapfish.print:print-lib

See all →