Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-73692
HistorySep 26, 2022 - 12:00 a.m.

Apache XML Graphics Batik Server-Side Request Forgery Vulnerability

2022-09-2600:00:00
China National Vulnerability Database
www.cnvd.org.cn
16

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache XML Graphics Batik is a Java-based application from the Apache Foundation that is primarily used to process images in SVG format.Apache XML Graphics Batik is vulnerable to server-side request forgery, which is caused by a flaw in the DefaultScriptSecurity function. An attacker could exploit the vulnerability to conduct an SSRF attack to access a file using a Jar url.

CPENameOperatorVersion
apache xml graphics batikeq1.14

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N