CVE-2022-44730
published 2023-08-22CVE-2022-44730: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A…
PriorityP420medium4.4CVSS 3.1
AVLACLPRNUIRSUCLILAN
EPSS
0.75%
50.8th percentile
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | batik | >= 0 < 1.12-4+deb11u2 | 1.12-4+deb11u2 |
| apache | batik | >= 0 < 1.16+dfsg-1+deb12u1 | 1.16+dfsg-1+deb12u1 |
| apache | batik | >= 0 < 1.17+dfsg-1 | 1.17+dfsg-1 |
| apache | batik | >= 0 < 1.17+dfsg-1 | 1.17+dfsg-1 |
| apache | xml_graphics_batik | 1.0 – 1.16 | — |
| apache_software_foundation | apache_xml_graphics_batik | — | — |
| debian | batik | < batik 1.16+dfsg-1+deb12u1 (bookworm) | batik 1.16+dfsg-1+deb12u1 (bookworm) |
| debian | debian_linux | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
osv4.4MEDIUM
vendor_debian4.4MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-44730: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik
osv·2023-08-22·CVSS 4.4
CVE-2022-44730 [MEDIUM] CVE-2022-44730: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
GHSA
Apache Batik information disclosure vulnerability
ghsa·2023-08-22
CVE-2022-44730 [MEDIUM] CWE-918 Apache Batik information disclosure vulnerability
Apache Batik information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
OSV
Apache Batik information disclosure vulnerability
osv·2023-08-22
CVE-2022-44730 [MEDIUM] Apache Batik information disclosure vulnerability
Apache Batik information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
Red Hat
batik: Server-Side Request Forgery vulnerability
vendor_redhat·2023-08-22·CVSS 4.4
CVE-2022-44730 [MEDIUM] CWE-918 batik: Server-Side Request Forgery vulnerability
batik: Server-Side Request Forgery vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
A flaw was found in Apache Batik, where a malicious SVG can probe user profile data and send it directly as parameter to a URL. This issue can allow an attacker to conduct SSRF attacks.
Package: batik (Red Hat build of Apache Camel for Spring Boot 3) - Affected
Package: batik (Red Hat build of OptaPlanner 8) - Not affected
Package: batik (Red Hat Data Grid 8) - Not affected
Package: batik (Red Hat Decision Manager 7) - Affected
Package: batik (Red Hat Enterprise Linux 6) - Out of support scop
Debian
CVE-2022-44730: batik - Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation A...
vendor_debian·2022·CVSS 4.4
CVE-2022-44730 [MEDIUM] CVE-2022-44730: batik - Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation A...
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
Scope: local
bookworm: resolved (fixed in 1.16+dfsg-1+deb12u1)
bullseye: resolved (fixed in 1.12-4+deb11u2)
forky: resolved (fixed in 1.17+dfsg-1)
sid: resolved (fixed in 1.17+dfsg-1)
trixie: resolved (fixed in 1.17+dfsg-1)
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2023/08/22/3http://www.openwall.com/lists/oss-security/2023/08/22/5https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0https://lists.debian.org/debian-lts-announce/2023/10/msg00021.htmlhttps://security.gentoo.org/glsa/202401-11https://xmlgraphics.apache.org/security.htmlhttp://www.openwall.com/lists/oss-security/2023/08/22/3http://www.openwall.com/lists/oss-security/2023/08/22/5https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0https://lists.debian.org/debian-lts-announce/2023/10/msg00021.htmlhttps://security.gentoo.org/glsa/202401-11https://xmlgraphics.apache.org/security.html
2023-08-22
Published