Log in Start free

Vulnerability · Published Feb 24, 2021 · Assigned by apache

CVE-2020-11988

High 8.2

In plain English

A high-severity security flaw in Apache XmlGraphics Commons. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.7% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.2High
Exploit odds (30 days)6.7%top 6.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12xmlgraphics-commons2.4-2DEBIAN-CVE-2020-11988
Debian:13xmlgraphics-commons2.4-2DEBIAN-CVE-2020-11988
Debian:14xmlgraphics-commons2.4-2DEBIAN-CVE-2020-11988
Mavenorg.apache.xmlgraphics:xmlgraphics-commons2.6GHSA-fmj2-7wx8-qj4v
Ubuntu:22.04:LTSxmlgraphics-commonsno fix listedUBUNTU-CVE-2020-11988
Ubuntu:24.04:LTSxmlgraphics-commonsno fix listedUBUNTU-CVE-2020-11988
Ubuntu:25.10xmlgraphics-commonsno fix listedUBUNTU-CVE-2020-11988
Ubuntu:26.04:LTSxmlgraphics-commonsno fix listedUBUNTU-CVE-2020-11988
Ubuntu:26.10xmlgraphics-commonsno fix listedUBUNTU-CVE-2020-11988

Affected products (as reported)

VendorProductVersions
n/a Apache XmlGraphics Commons Apache XmlGraphics Commons – before 2.6

References