CVE-2020-15231: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in mapfish-print versions before 3.24. The vulnerability exists due to the JSONP (JSON with Padding) support functionality that could be exploited to perform cross-site scripting attacks (GitHub Advisory).

The vulnerability is tracked as CVE-2020-15231 and has been assigned a CVSS v3.1 base score of 6.1 MEDIUM (NIST NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). However, GitHub's assessment rates it as CRITICAL with a score of 9.3 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The vulnerability stems from the implementation of JSONP support in the application, which could be exploited to perform cross-site scripting attacks (NIST NVD).

The vulnerability allows attackers to perform cross-site scripting (XSS) attacks through the JSONP support functionality. This could potentially lead to the execution of malicious scripts in the context of the victim's browser session, potentially compromising sensitive information or performing actions on behalf of the user (GitHub Advisory).

The vulnerability can be exploited by leveraging the JSONP support functionality. No specific exploit conditions or examples have been publicly disclosed (NIST NVD).

The vulnerability has been fixed in mapfish-print version 3.24. Users are advised to upgrade to this version or later. No workarounds have been provided for users who cannot upgrade (GitHub Advisory).