CVEvulnerability
CVE-2020-11987
8.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-02-24
- Last modified
- 2026-10-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-20, CWE-918
Description
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Affected configurations
• apache batik (<= 1.13)
• fedoraproject fedora 33
• fedoraproject fedora 34
• oracle agile engineering data management 6.2.1.0
• oracle banking apis 18.3
• oracle banking apis 19.1
• oracle banking apis 19.2
• oracle banking apis 20.1
• oracle banking apis 21.1
• oracle banking digital experience 18.3
• oracle banking digital experience 19.1
• oracle banking digital experience 19.2
• oracle banking digital experience 20.1
• oracle banking digital experience 21.1
• oracle communications application session controller 3.9m0p3
• oracle communications metasolv solution 6.3.0
• oracle communications metasolv solution 6.3.1
• oracle communications offline mediation controller 12.0.0.3.0
• oracle enterprise repository 11.1.1.7.0
• oracle flexcube universal banking (>= 14.1.0 <= 14.4.0)
• oracle fusion middleware mapviewer 12.2.1.4.0
• oracle instantis enterprisetrack 17.1
• oracle instantis enterprisetrack 17.2
• oracle instantis enterprisetrack 17.3
• oracle insurance policy administration (>= 11.0 <= 11.3.1)
• oracle product lifecycle analytics 3.6.1
• oracle retail back office 14.1
• oracle retail central office 14.1
• oracle retail order broker 15.0
• oracle retail order broker 16.0
• oracle retail order management system cloud service 19.5
• oracle retail point-of-service 14.1
• oracle retail returns management 14.1
• oracle weblogic server 12.2.1.3.0
• oracle weblogic server 12.2.1.4.0
• oracle weblogic server 14.1.1.0.0
• debian debian linux 10.0
Related
References
- https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E Mailing List, Vendor Advisory
- https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202401-11 Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://xmlgraphics.apache.org/security.html Release Notes, Vendor Advisory
- https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E Mailing List, Vendor Advisory
- https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202401-11 Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://xmlgraphics.apache.org/security.html Release Notes, Vendor Advisory