Apache Batik vulnerable to Server-Side Request Forgery

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-38648 · ADVISORY
• apache/xmlgraphics-batik commit 996aa88 · WEB
• apache/xmlgraphics-batik · PACKAGE
• issues.apache.org/jira/browse/BATIK-1333 · WEB
• lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b · WEB
• lists.debian.org/debian-lts-announce/2023/10/msg00021.html · WEB
• lists.debian.org/debian-lts-announce/2025/07/msg00006.html · WEB
• security.gentoo.org/glsa/202401-11 · WEB

org.apache.xmlgraphics:batik のその他の脆弱性

• CVE-2022-42890高 7.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Ap…
• CVE-2022-41704高 7.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Gra…
• CVE-2022-40146高 7.5Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This is…
• CVE-2022-38398中 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. Thi…
• CVE-2019-17566高 7.5Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a sp…