CVEvulnerability
CVE-2022-44729
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-08-22
- Last modified
- 2026-10-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- Weaknesses
- CWE-918
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Affected configurations
• apache xml graphics batik (>= 1.0 <= 1.16)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
- https://security.gentoo.org/glsa/202401-11 security.gentoo.org
- https://xmlgraphics.apache.org/security.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
- https://security.gentoo.org/glsa/202401-11 security.gentoo.org
- https://xmlgraphics.apache.org/security.html Vendor Advisory