CVEvulnerability
CVE-2022-42890
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-10-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-918
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Affected configurations
• apache batik (>= 1.0 < 1.16)
• debian debian linux 10.0
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- http://www.openwall.com/lists/oss-security/2022/10/25/3 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202401-11 security.gentoo.org
- https://www.debian.org/security/2022/dsa-5264 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/25/3 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202401-11 security.gentoo.org
- https://www.debian.org/security/2022/dsa-5264 Third Party Advisory