GitHub Advisoryadvisory · Maven

GHSA-gq5f-xv48-2365 Apache XML Graphics Batik Server-Side Request Forgery vulnerability

HIGH Published 2023-08-22 Modified 2025-02-13 Official page ↗
Aliases
CVE-2022-44729
Ecosystem
Maven
Packages
org.apache.xmlgraphics:batik-bridge, org.apache.xmlgraphics:batik-svgrasterizer, org.apache.xmlgraphics:batik-transcoder
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weaknesses
CWE-918
Reviewed
2023-08-23

Affected packages

• Maven org.apache.xmlgraphics:batik-bridge: >= 1.0, < 1.17 → fixed in 1.17 • Maven org.apache.xmlgraphics:batik-svgrasterizer: >= 1.0, < 1.17 → fixed in 1.17 • Maven org.apache.xmlgraphics:batik-transcoder: >= 1.0, < 1.17 → fixed in 1.17

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

Related

Alias · CVE (1)

  • CVE-2022-44729 Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References