CVE-2022-44729
published 2023-08-22CVE-2022-44729: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On…
PriorityP430high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
EPSS
0.79%
52.0th percentile
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | batik | >= 0 < 1.12-4+deb11u2 | 1.12-4+deb11u2 |
| apache | batik | >= 0 < 1.16+dfsg-1+deb12u1 | 1.16+dfsg-1+deb12u1 |
| apache | batik | >= 0 < 1.17+dfsg-1 | 1.17+dfsg-1 |
| apache | batik | >= 0 < 1.17+dfsg-1 | 1.17+dfsg-1 |
| apache | xml_graphics_batik | 1.0 – 1.16 | — |
| apache_software_foundation | apache_xml_graphics_batik | — | — |
| atlassian | jira_service_management | — | — |
| debian | batik | < batik 1.16+dfsg-1+deb12u1 (bookworm) | batik 1.16+dfsg-1+deb12u1 (bookworm) |
| debian | debian_linux | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_oracle7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy Asset Suite
cisa_ics·2025-09-18·CVSS 7.1
[HIGH] Hitachi Energy Asset Suite
ICS Advisory
##
Hitachi Energy Asset Suite
Release DateSeptember 18, 2025
Alert CodeICSA-25-261-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Asset Suite
- Vulnerabilities: Server-Side Request Forgery (SSRF), Deserialization of Untrusted Data, Cleartext Storage of Sensitive Information, Uncontrolled Resource Consumption, URL Redirection to Untrusted Site ('Open Redirect'), Improper Authentication
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow attackers to trigger resource consumption or information disclosure through SSRF in Apache XML Gra
Atlassian
CVE-2022-44729: SSRF org.apache.xmlgraphics:batik-bridge Dependency in Jira Service Management Data Center and Server
vendor_atlassian·2024-01-16·CVSS 7.1
CVE-2022-44729 [HIGH] CVE-2022-44729: SSRF org.apache.xmlgraphics:batik-bridge Dependency in Jira Service Management Data Center and Server
CVE-2022-44729: SSRF org.apache.xmlgraphics:batik-bridge Dependency in Jira Service Management Data Center and Server
SSRF org.apache.xmlgraphics:batik-bridge Dependency in Jira Service Management Data Center and Server
CVE: CVE-2022-44729
Severity: HIGH
Affected products: Jira Service Management
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache Batik) — CVE-2022-44729
vendor_oracle·2024-01-15·CVSS 7.1
CVE-2022-44729 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache Batik) — CVE-2022-44729
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache Batik) vulnerability
CVE: CVE-2022-44729
CVSS: 7.1
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Spatial and Graph (Apache Batik) — CVE-2022-44729
vendor_oracle·2023-10-15·CVSS 6.0
CVE-2022-44729 [HIGH] Oracle Oracle Database Server Risk Matrix: Oracle Spatial and Graph (Apache Batik) — CVE-2022-44729
Oracle Oracle Database Server Risk Matrix: Oracle Spatial and Graph (Apache Batik) vulnerability
CVE: CVE-2022-44729
CVSS: 6.0
Protocol: HTTP
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2023 (OCT 2023)
Red Hat
batik: Server-Side Request Forgery vulnerability
vendor_redhat·2023-08-22·CVSS 7.1
CVE-2022-44729 [HIGH] CWE-918 batik: Server-Side Request Forgery vulnerability
batik: Server-Side Request Forgery vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure.
Package: batik (Red Hat build of Apache Camel for Spring Boot 3) - Affected
Package: batik (Red Hat build of OptaPlanner 8) - Not affected
Package: batik (Red Hat
Debian
CVE-2022-44729: batik - Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation A...
vendor_debian·2022·CVSS 7.1
CVE-2022-44729 [HIGH] CVE-2022-44729: batik - Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation A...
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Scope: local
bookworm: resolved (fixed in 1.16+dfsg-1+deb12u1)
bullseye: resolved (fixed in 1.12-4+deb11u2)
forky: resolved (fixed in 1.17+dfsg-1)
sid: resolved (fixed in 1.17+dfsg-1)
trixie: resolved (fixed in 1.17+dfsg-1)
GHSA
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
ghsa·2023-08-22
CVE-2022-44729 [HIGH] CWE-918 Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
OSV
CVE-2022-44729: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik
osv·2023-08-22·CVSS 7.1
CVE-2022-44729 [HIGH] CVE-2022-44729: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
OSV
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
osv·2023-08-22
CVE-2022-44729 [HIGH] Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2023/08/22/2http://www.openwall.com/lists/oss-security/2023/08/22/4https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2https://lists.debian.org/debian-lts-announce/2023/10/msg00021.htmlhttps://security.gentoo.org/glsa/202401-11https://xmlgraphics.apache.org/security.htmlhttp://www.openwall.com/lists/oss-security/2023/08/22/2http://www.openwall.com/lists/oss-security/2023/08/22/4https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2https://lists.debian.org/debian-lts-announce/2023/10/msg00021.htmlhttps://security.gentoo.org/glsa/202401-11https://xmlgraphics.apache.org/security.html
2023-08-22
Published