Security readout for executives and security teams
Plain-English summary
MPXJ through 8.1.3 can mishandle XML input in two project-file readers. A malicious project file could make the application read external XML entities, potentially exposing data, changing processing behavior, or disrupting service depending on deployment context.
Executive priority
Treat this as high-priority if MPXJ is used in file import workflows. The business risk is greatest in externally facing systems that parse project files from untrusted sources.
Technical view
CVE-2020-25020 is a CWE-611 XML External Entity issue affecting MPXJ GanttProjectReader and PhoenixReader through version 8.1.3. The CVSS 3.1 score is 9.8, reflecting network attack vector, low complexity, no privileges, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where applications use MPXJ to import GanttProject or Phoenix project files, especially files supplied by customers, partners, email, uploads, or automated integrations.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Risk comes from untrusted XML-based project-file parsing and the high CVSS impact assigned to XXE behavior.
Researcher notes
The public record names affected components but the bundle does not provide detailed exploit conditions, fixed version, or observed exploitation. Validate impact against actual parser entry points and trust boundaries.
Mitigation direction
- Inventory MPXJ usage and identify versions through 8.1.3.
- Prioritize updating MPXJ according to project or vendor guidance.
- Restrict processing of untrusted GanttProject and Phoenix files until remediated.
- If maintaining parser code, ensure external entity resolution is disabled.
- Monitor vendor and downstream product advisories, including Oracle CPU references.
Validation and detection
- Check dependency manifests and runtime artifacts for MPXJ versions.
- Identify code paths invoking GanttProjectReader or PhoenixReader.
- Confirm whether file imports accept untrusted or external project files.
- Review vendor commit and advisory references for fixed-version guidance.
- Look for unexpected file-read or outbound access around project imports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-25020 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9CVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2021.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.