GoogleOSV:GHSA-GQ5F-XV48-2365Apache XML Graphics Batik Server-Side Request Forgery vulnerability
7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
0.001 Low
EPSS
Percentile
40.9%
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
References
www.openwall.com/lists/oss-security/2023/08/22/2
www.openwall.com/lists/oss-security/2023/08/22/4
github.com/apache/xmlgraphics-batik
github.com/apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d5ba47d0b69b
github.com/apache/xmlgraphics-batik/commit/aaa1dd3e6b5a7df781d73e0c37a1df6a8f318893
issues.apache.org/jira/browse/BATIK-1349
lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2
lists.debian.org/debian-lts-announce/2023/10/msg00021.html
nvd.nist.gov/vuln/detail/CVE-2022-44729
security.gentoo.org/glsa/202401-11
xmlgraphics.apache.org/security.html
Related
7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
0.001 Low
EPSS
Percentile
40.9%