Description

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Remediation

References

https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e

https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw

Related Vulnerabilities

CVE-2021-29479 Vulnerability in maven package io.ratpack:ratpack-core

CVE-2020-4059 Vulnerability in npm package mversion

CVE-2022-24827 Vulnerability in maven package com.yahoo.elide:elide-datastore-aggregation

CVE-2023-31125 Vulnerability in maven package org.webjars.npm:engine.io

CVE-2021-21317 Vulnerability in npm package uap-core

Severity

Critical

Classification

CWE-611 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Patch Third Party Advisory