Description

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Remediation

References

https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e

https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw

Related Vulnerabilities

CVE-2022-0401 Vulnerability in npm package w-zip

CVE-2023-37964 Vulnerability in maven package org.jenkins-ci.plugins:elasticbox

CVE-2014-7810 Vulnerability in maven package org.apache.tomcat:el-api

CVE-2021-21193 Vulnerability in npm package electron

CVE-2022-1440 Vulnerability in npm package git-interface

Severity

Critical

Classification

CWE-611 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Patch Third Party Advisory