| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.xmlgraphics:batik-svgbrowser | < 1.14 | 1.14 |
| batik | ≤ 1.13 | |
| agile engineering data management | = 6.2.1.0 | |
| banking apis | = 18.3= 19.1= 19.2= 20.1= 21.1 | |
| banking digital experience | = 18.3= 19.1= 19.2= 20.1= 21.1 | |
| communications application session controller | = 3.9m0p3 | |
| communications metasolv solution | = 6.3.0= 6.3.1 | |
| communications offline mediation controller | = 12.0.0.3.0 | |
| enterprise repository | = 11.1.1.7.0 | |
| flexcube universal banking | ≥ 14.1.0, ≤ 14.4.0 | |
| fusion middleware mapviewer | = 12.2.1.4.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| insurance policy administration | ≥ 11.0, ≤ 11.3.1 | |
| product lifecycle analytics | = 3.6.1 | |
| retail back office | = 14.1 | |
| retail central office | = 14.1 | |
| retail order broker | = 15.0= 16.0 | |
| retail order management system cloud service | = 19.5 | |
| retail point-of-service | = 14.1 | |
| retail returns management | = 14.1 | |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0 |
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free