GHSA-53jm-3hc9-fqqc

Apache Batik vulnerable to Server-Side Request Forgery

En bref

Publiée: 2022-09-23 00:00 UTC
Mise à jour: 2025-11-03 22:02 UTC
CVE: CVE-2022-38648
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.

Paquets affectés

Paquet	Versions
Maven · org.apache.xmlgraphics:batik	introduced 0, fixed 1.15
Maven · org.apache.xmlgraphics:batik-bridge	introduced 0, fixed 1.15

Références

https://nvd.nist.gov/vuln/detail/CVE-2022-38648 ADVISORY
https://github.com/apache/xmlgraphics-batik/commit/996aa8897c208be11ce65cef00c9576a299b2637 WEB
https://github.com/apache/xmlgraphics-batik PACKAGE
https://issues.apache.org/jira/browse/BATIK-1333 WEB
https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b WEB
https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html WEB
https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html WEB
https://security.gentoo.org/glsa/202401-11 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database