Paper/Archive/CVE-2020-15231

CVE-2020-15231

mapfish mapfish-print — Cross-site scripting attack in mapfish-print

EPSS 0.8%CVSS 9.3

critical.is priorityof 100

39

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 56.6.566 × 2011.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Affected

ProductAffectedFixed inSource

mapfish-print< 3.24–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

refgithub.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2 refgithub.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e