GitHub Advisoryadvisory · Maven
GHSA-rwqr-m72q-v6cm Untrusted code execution in Apache XML Graphics Batik
HIGH
Official page ↗
- Aliases
- CVE-2022-42890
- Ecosystem
- Maven
- Packages
- org.apache.xmlgraphics:batik, org.apache.xmlgraphics:batik-bridge
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-918
- Reviewed
- 2022-10-25
Affected packages
• Maven org.apache.xmlgraphics:batik: < 1.16 → fixed in 1.16
• Maven org.apache.xmlgraphics:batik-bridge: < 1.16 → fixed in 1.16
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Related
Alias · CVE (1)
- CVE-2022-42890 A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-42890 advisory
- https://github.com/apache/xmlgraphics-batik/commit/401aa8595f52d085d40ff5b6b4ac0dd372423082 web
- https://github.com/apache/xmlgraphics-batik/commit/52f7a1ad6e3110ec295a35ffc94410eef085707a web
- https://github.com/apache/xmlgraphics-batik/commit/eada57c716a2757579d53017f8b2aeadaad20edd web
- https://issues.apache.org/jira/browse/BATIK-1345 web
- https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly web
- https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html web
- https://security.gentoo.org/glsa/202401-11 web
- https://www.debian.org/security/2022/dsa-5264 web
- https://xmlgraphics.apache.org/security.html web
- http://svn.apache.org/repos/asf/xmlgraphics/batik/trunk web
- http://www.openwall.com/lists/oss-security/2022/10/25/3 web