CVE-2020-11988

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

• CWE-20
• CWE-918

• https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E
• https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E
• https://lists.apache.org/thread.html/ra8f4d6ae402ec020ee3e8c28632c91be131c4d8b4c9c6756a179b12b%40%3Cdev.jmeter.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22HESSYU7T4D6GGENUVEX3X3H6FGBECH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JP4XA56DA3BFNRBBLBXM6ZAI5RUVFA33/
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://xmlgraphics.apache.org/security.htmlRelease Notes, Vendor Advisory
• https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E
• https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E
• https://lists.apache.org/thread.html/ra8f4d6ae402ec020ee3e8c28632c91be131c4d8b4c9c6756a179b12b%40%3Cdev.jmeter.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22HESSYU7T4D6GGENUVEX3X3H6FGBECH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JP4XA56DA3BFNRBBLBXM6ZAI5RUVFA33/
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://xmlgraphics.apache.org/security.htmlRelease Notes, Vendor Advisory

Published

Feb 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11982An issue was found in Apache Airflow versions 1.10.10 and be…9.8
• CVE-2020-11983An issue was found in Apache Airflow versions 1.10.10 and be…5.4
• CVE-2020-11984Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info dis…9.8
• CVE-2020-11985IP address spoofing when proxying using mod_remoteip and mod…5.3
• CVE-2020-11986To be able to analyze gradle projects, the build scripts nee…9.8
• CVE-2020-11987Apache Batik 1.13 is vulnerable to server-side request forge…8.2
• CVE-2020-11989Apache Shiro before 1.5.3, when using Apache Shiro with Spri…9.8
• CVE-2020-1199An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11990We have resolved a security issue in the camera plugin that …3.3
• CVE-2020-11991When using the StreamGenerator, the code parse a user-provid…7.5
• CVE-2020-11992Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-11993Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debu…7.5