7.1high
CVE-2022-44729
Apache XML Graphics Batik: Information disclosure vulnerability
Also known as GHSA-gq5f-xv48-2365
Published 3 y ago · modified 29 d ago · JSON
CVSS
7.1
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
0
none known
Summary
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 29 d ago
Exploit prediction (EPSS)
0.92% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.xmlgraphics:batik-bridge | >=1.0, <1.17 | 1.17 |
| maven | org.apache.xmlgraphics:batik-svgrasterizer | >=1.0, <1.17 | 1.17 |
| maven | org.apache.xmlgraphics:batik-transcoder | >=1.0, <1.17 | 1.17 |
Affected products
- Apache Software Foundation Apache XML Graphics Batik
Classification
- Weakness
- CWE-918 Server-Side Request Forgery
References
- xmlgraphics.apache.org /security.html · x_transferred
- lists.apache.org /thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 · vendor-advisory, x_transferred
- openwall.com /lists/oss-security/2023/08/22/2 · x_transferred
- openwall.com /lists/oss-security/2023/08/22/4 · x_transferred
- lists.debian.org /debian-lts-announce/2023/10/msg00021.html · x_transferred
- security.gentoo.org /glsa/202401-11 · x_transferred
- nvd.nist.gov /vuln/detail/CVE-2022-44729 · advisory
- github.com /apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d5ba47d0b69b · web
- github.com /apache/xmlgraphics-batik/commit/aaa1dd3e6b5a7df781d73e0c37a1df6a8f318893 · web
- github.com /apache/xmlgraphics-batik · package
- issues.apache.org /jira/browse/BATIK-1349 · web
Sources
- CVE List: CVE-2022-44729
- GitHub Advisory: GHSA-gq5f-xv48-2365
- NVD: CVE-2022-44729
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.