CVE-2020-11988

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-20CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-119899.8Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication CVE-2020-11997.8An elevation of privilege vulnerability exists when the Windows Feedback Hub improperly handles objects in memory, aka 'Windows Feedback HubCVE-2020-119903.3We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who coulCVE-2020-119917.5When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be usCVE-2020-119937.5Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logginCVE-2020-119947.5Server-Side Template Injection and arbitrary file disclosure on Camel templating componentsCVE-2020-119959.8A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo usCVE-2020-119967.5A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could tCVE-2020-119974.3Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users shaCVE-2020-119989.8A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead ofCVE-2020-119998.1FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContCVE-2020-12008.6<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application
CVE-2020-11988: High severity, CVSS 8.2 | Vulnix