XXE attack in Mapfish Print

CRITICAL 9.1CVE-2020-15232 · GHSA-vjv6-gq77-3mjw · Published 02/10/2020 · updated 17/06/2026

In short

CVE-2020-15232 is a CRITICAL (CVSS 9.1) vulnerability affecting org.mapfish.print:print-lib, org.mapfish.print:print-servlet, org.mapfish.print:print-standalone.
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 71.4% of all vulnerabilities.
Fix: update to 3.24 or later.

Package	Affected versions	Patched versions
org.mapfish.print:print-lib Maven	`≥ 3.0, < 3.24`	`3.24`
org.mapfish.print:print-servlet Maven	`≥ 3.0, < 3.24`	`3.24`
org.mapfish.print:print-standalone Maven	`≥ 3.0, < 3.24`	`3.24`
print mapfish	`< 3.24`	`3.24`

A user can do to an XML External Entity (XXE) attack with the provided SDL style.

Use version >= 3.24

If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

NVD description

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≥ 3.0, < 3.24

3.24

Maven

≥ 3.0, < 3.24

3.24

Maven

≥ 3.0, < 3.24

3.24

< 3.24

3.24

Description

NVD description

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

More vulnerabilities in org.mapfish.print:print-lib

See all →