GitHub Advisoryadvisory · Maven

GHSA-53jm-3hc9-fqqc Apache Batik vulnerable to Server-Side Request Forgery

MEDIUM Published 2022-09-23 Modified 2025-11-03 Official page ↗
Aliases
CVE-2022-38648
Ecosystem
Maven
Packages
org.apache.xmlgraphics:batik, org.apache.xmlgraphics:batik-bridge
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-09-23

Affected packages

• Maven org.apache.xmlgraphics:batik: < 1.15 → fixed in 1.15 • Maven org.apache.xmlgraphics:batik-bridge: < 1.15 → fixed in 1.15

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.

Related

Alias · CVE (1)

  • CVE-2022-38648 Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References