CVEvulnerability

CVE-2019-17566

7.5 HIGH Published 2020-11-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-918

Description

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected configurations

• apache batik (< 1.13) • oracle api gateway 11.1.2.4.0 • oracle business intelligence 5.5.0.0.0 • oracle business intelligence 5.9.0.0.0 • oracle business intelligence 12.2.1.3.0 • oracle business intelligence 12.2.1.4.0 • oracle communications application session controller 3.9m0p2 • oracle communications metasolv solution (>= 6.3.0 <= 6.3.1) • oracle communications offline mediation controller 12.0.0.3.0 • oracle enterprise repository 11.1.1.7.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.1.0) • oracle fusion middleware mapviewer 12.2.1.4.0 • oracle hospitality opera 5 5.5 • oracle hospitality opera 5 5.6 • oracle hyperion financial reporting 11.1.2.4 • oracle hyperion financial reporting 11.2.5.0 • oracle instantis enterprisetrack (>= 17.1 <= 17.3) • oracle jd edwards enterpriseone tools (< 9.2.4.0) • oracle jd edwards enterpriseone tools 9.2.4.2 • oracle retail integration bus 15.0.3 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail order management system cloud service 19.5 • oracle retail point-of-service 14.1 • oracle retail returns management 14.1

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References