What’s Vulnerable › Vulnerabilities

CVE-2020-25020

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-29 · updated 2026-06-17
• Weakness: CWE-611

Description

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

Affected products

• joniles mpxj: through 8.1.3
• Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12, 20.12

References

• https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9
• https://www.oracle.com/security-alerts/cpujan2021.html

Get alerted when CVE-2020-25020 or the next vulnerability affects your stack