GitHub Advisoryadvisory · Maven

GHSA-cmx4-p4v5-hmr5 Server-side request forgery (SSRF) in Apache Batik

HIGH Published 2022-02-09 Modified 2022-02-08 Official page ↗
Aliases
CVE-2019-17566
Ecosystem
Maven
Packages
org.apache.xmlgraphics:batik
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-918
Reviewed
2021-03-31

Affected packages

• Maven org.apache.xmlgraphics:batik: < 1.13 → fixed in 1.13

Description

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Related

Alias · CVE (1)

  • CVE-2019-17566 Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-918 Server-Side Request Forgery weakness

References