CVE-2019-17566

HIGH

Apache Batik < 1.13 - Server-Side Request Forgery via xlink:href Attribute

Title source: llm
STIX 2.1

Description

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

References (10)

Core 10
Core References
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202401-11

Scores

CVSS v3 7.5
EPSS 0.0081
EPSS Percentile 74.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-918
Status published
Products (26)
apache/batik < 1.13
oracle/api_gateway 11.1.2.4.0
oracle/business_intelligence 5.5.0.0.0
oracle/business_intelligence 5.9.0.0.0
oracle/business_intelligence 12.2.1.3.0
oracle/business_intelligence 12.2.1.4.0
oracle/communications_application_session_controller 3.9m0p2
oracle/communications_metasolv_solution 6.3.0 - 6.3.1
oracle/communications_offline_mediation_controller 12.0.0.3.0
oracle/enterprise_repository 11.1.1.7.0
... and 16 more
Published Nov 12, 2020
Tracked Since Feb 18, 2026