Severity: High2022-01-19
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
The Oxygen PDF Chemistry product incorporates the Apache XmlGraphics Commons 2.4 as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.
| Product | Severity | Fixed Release Availability |
| Oxygen PDF Chemistry between v22.0 and v22.1 | High | Oxygen PDF Chemistry 22.1 build 2021121712 |
CVE-2020-11988
Severity: High
CVSS Score: 8.2
The Apache XmlGraphics Commons third-party library used by Oxygen PDF Chemistry product is an affected version mentioned in CVE-2020-11988 vulnerability description.
Starting with Oxygen PDF Chemistry v22.1 build 2021121712, the Apache XmlGraphics Commons library was updated to version 2.6 which fixes this vulnerability.
This website was created & generated with <oXygen/>®XML Editor
