← All advisories

Critical severity9.8NVD Advisory· Published Aug 29, 2020· Updated Jun 17, 2026

CVE-2020-25020

CVE-2020-25020

Description

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
net.sf.mpxj:mpxjMaven	< 8.1.4	8.1.4

Affected products

9

Mpxj/Mpxj
cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:*
Range: <=8.1.3
Oracle Corporation/Primavera Unifier6 versions
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*range: >=17.7,<=17.12
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
MPXJ/MPXJdescription
ghsa-coords
pkg:maven/net.sf.mpxj/mpxj
Range: < 8.1.4

Patches

Vulnerability mechanics

References

5

github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9nvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-wcp5-m52f-mhh5ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-25020ghsaADVISORY
github.com/joniles/mpxj/releases/tag/v8.1.4ghsaWEB

News mentions

0

No linked articles in our index yet.