Server-side request forgery (SSRF) in Apache XmlGraphics Commons

높음 8.2CVE-2020-11988 · GHSA-fmj2-7wx8-qj4v · Published 24/02/2021 · updated 17/06/2026

요약

CVE-2020-11988은(는) org.apache.xmlgraphics:xmlgraphics-commons, xmlgraphics commons (apache)에 영향을 주는 높음 (CVSS 8.2) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 6.7%, 전체 취약점의 93.9%보다 높음.
조치: 2.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.apache.xmlgraphics:xmlgraphics-commons Maven	`< 2.6`	`2.6`
xmlgraphics commons apache	`≤ 2.4`	No fix yet

Description

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

NVD description

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free