| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.xmlgraphics:batik | < 1.13 | 1.13 |
| batik | < 1.13 | 1.13 |
| api gateway | = 11.1.2.4.0 | |
| business intelligence | = 12.2.1.3.0= 12.2.1.4.0= 5.5.0.0.0= 5.9.0.0.0 | |
| communications application session controller | = 3.9m0p2 | |
| communications metasolv solution | ≥ 6.3.0, ≤ 6.3.1 | |
| communications offline mediation controller | = 12.0.0.3.0 | |
| enterprise repository | = 11.1.1.7.0 | |
| financial services analytical applications infrastructure | ≥ 8.0.6, ≤ 8.1.0 | |
| fusion middleware mapviewer | = 12.2.1.4.0 | |
| hospitality opera 5 | = 5.5= 5.6 | |
| hyperion financial reporting | = 11.1.2.4= 11.2.5.0 | |
| instantis enterprisetrack | ≥ 17.1, ≤ 17.3 | |
| jd edwards enterpriseone tools | = 9.2.4.2< 9.2.4.0 | 9.2.4.0 |
| retail integration bus | = 15.0.3 | |
| retail order broker | = 15.0= 16.0 | |
| retail order management system cloud service | = 19.5 | |
| retail point-of-service | = 14.1 | |
| retail returns management | = 14.1 |
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free