PT-2021-5808 · Apache+3 · Apache Xmlgraphics Commons+3

Published 2021-02-24 · Updated 2025-05-22 · CVE-2020-11988

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache XmlGraphics Commons versions 2.4 and earlier

Description The issue is related to server-side request forgery caused by improper input validation by the XMPParser. An attacker could exploit this by using a specially-crafted argument to cause the underlying server to make arbitrary GET requests. This could potentially allow a remote attacker to access confidential data and compromise its integrity.

Recommendations For Apache XmlGraphics Commons versions 2.4 and earlier, users should upgrade to version 2.6 or later to resolve the issue. As a temporary workaround, consider restricting input validation to prevent exploitation until a patch is applied.

Fix

SSRF

RCE

Weakness Enumeration

CWE-918

CWE-20

Related Identifiers

ALT-PU-2025-6398

BDU:2022-00276

CVE-2020-11988

GHSA-FMJ2-7WX8-QJ4V

MGASA-2021-0144

OESA-2022-1649

OPENSUSE-SU-2024:12403-1

SUSE-SU-2022:3550-1

SUSE-SU-2022_3550-1

Affected Products

Alt Linux

Apache Xmlgraphics Commons

Astra Linux

Suse

References · 42

• https://xmlgraphics.apache.org/security.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11988 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11988 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00276 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3550-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/22HESSYU7T4D6GGENUVEX3X3H6FGBECH · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JP4XA56DA3BFNRBBLBXM6ZAI5RUVFA33 · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11988 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11988 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0144.html · Security Note
• https://osv.dev/vulnerability/GHSA-fmj2-7wx8-qj4v · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JP4XA56DA3BFNRBBLBXM6ZAI5RUVFA33 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22HESSYU7T4D6GGENUVEX3X3H6FGBECH · Vendor Advisory