CVE-2020-11988 - Server-side Request Forgery (SSRF)

Severity: High2022-01-19

Abstract

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.

The Oxygen PDF Chemistry product incorporates the Apache XmlGraphics Commons 2.4 as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Product	Severity	Fixed Release Availability
Oxygen PDF Chemistry between v22.0 and v22.1	High	Oxygen PDF Chemistry 22.1 build 2021121712

Mitigation

None

Detail

CVE-2020-11988

Severity: High

CVSS Score: 8.2

The Apache XmlGraphics Commons third-party library used by Oxygen PDF Chemistry product is an affected version mentioned in CVE-2020-11988 vulnerability description.

Starting with Oxygen PDF Chemistry v22.1 build 2021121712, the Apache XmlGraphics Commons library was updated to version 2.6 which fixes this vulnerability.

List of Security Advisories