GitHub Advisoryadvisory · Maven

GHSA-h3wv-47xm-4mg6 Server Side Request Forgery in svgSalamander

HIGH Published 2018-10-19 Modified 2022-09-14 Official page ↗
Aliases
CVE-2017-5617
Ecosystem
Maven
Packages
com.kitfox.svg:svg-salamander
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weaknesses
CWE-918
Reviewed
2020-06-16

Affected packages

• Maven com.kitfox.svg:svg-salamander: < 1.1.2 → fixed in 1.1.2

Description

The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.

Related

Alias · CVE (1)

  • CVE-2017-5617 The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References