Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-73693
HistorySep 26, 2022 - 12:00 a.m.

Apache XML Graphics Batik Server-Side Request Forgery Vulnerability (CNVD-2022-73693)

2022-09-2600:00:00
China National Vulnerability Database
www.cnvd.org.cn
9

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache XML Graphics Batik is a Java-based application from the Apache Foundation that is primarily used to process images in SVG format.A server-side request forgery vulnerability exists in Apache XML Graphics Batik due to a flaw in the A flaw in the DefaultExternalResourceSecurity function causes the vulnerability. An attacker could exploit this vulnerability to conduct an SSRF attack to load the url via the jar protocol.

CPENameOperatorVersion
apache xml graphics batikeq1.14

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N