CVE-2019-17566

🗓️ 12 Nov 2020 00:00:00Reported by apacheType

Apache Batik vulnerability due to improper input validation by "xlink:href" attributes, leading to server-side request forgery

Reporter	Title	Published	Views	Family All 127
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Business Monitor (CVE-2019-17566)	27 Aug 202007:16	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilty have been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager(CVE-2019-17566)	31 Aug 202020:16	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability Has Been Identified In Apache Batik used by IBM WebSphere Application Server which is shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2019-17566)	9 Sep 202003:12	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Batik affects WebSphere Application Server (CVE-2019-17566)	25 Aug 202021:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in WebSphere Application Server affect Predictive Maintenance and Quality and Predictive Maintenance Insights	19 Oct 202015:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Batik affects WebSphere Application Server shipped with IBM WebSphere Application Server Patterns (CVE-2019-17566)	26 Aug 202014:19	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere® Application Server shipped with IBM® Intelligent Operations Center (CVE-2019-17566)	27 Aug 202017:38	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2019-17566)	14 Sep 202215:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM StoredIQ for Legal	4 Mar 202109:24	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Apache Batik used by IBM Jazz Reporting Service	4 Oct 202310:43	–	ibm

NVD

Vulners

Node

apache batikRange<1.13

Node

oracle api_gatewayMatch11.1.2.4.0

oracle business_intelligenceMatch5.5.0.0.0enterprise

oracle business_intelligenceMatch5.9.0.0.0enterprise

oracle business_intelligenceMatch12.2.1.3.0enterprise

oracle business_intelligenceMatch12.2.1.4.0enterprise

oracle communications_application_session_controllerMatch3.9m0p2

oracle communications_metasolv_solutionRange6.3.0–6.3.1

oracle communications_offline_mediation_controllerMatch12.0.0.3.0

oracle enterprise_repositoryMatch11.1.1.7.0

oracle financial_services_analytical_applications_infrastructureRange8.0.6–8.1.0

oracle fusion_middleware_mapviewerMatch12.2.1.4.0

oracle hospitality_opera_5Match5.5

oracle hospitality_opera_5Match5.6

oracle hyperion_financial_reportingMatch11.1.2.4

oracle hyperion_financial_reportingMatch11.2.5.0

oracle instantis_enterprisetrackRange17.1–17.3

oracle jd_edwards_enterpriseone_toolsRange<9.2.4.0

oracle jd_edwards_enterpriseone_toolsMatch9.2.4.2

oracle retail_integration_busMatch15.0.3

oracle retail_order_brokerMatch15.0

oracle retail_order_brokerMatch16.0

oracle retail_order_management_system_cloud_serviceMatch19.5

oracle retail_point-of-serviceMatch14.1

oracle retail_returns_managementMatch14.1

[
  {
    "vendor": "n/a",
    "product": "Apache Batik",
    "versions": [
      {
        "version": "Apache Batik 1.12 and older",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171%40%3Ccommits.myfaces.apache.org%3E
oracle	www.oracle.com/security-alerts/cpujan2021.html
lists	www.lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509%40%3Ccommits.myfaces.apache.org%3E
xmlgraphics	www.xmlgraphics.apache.org/security.html
oracle	www.oracle.com//security-alerts/cpujul2021.html
security	www.security.gentoo.org/glsa/202401-11
oracle	www.oracle.com/security-alerts/cpuApr2021.html
oracle	www.oracle.com/security-alerts/cpujan2022.html
oracle	www.oracle.com/security-alerts/cpujul2022.html
oracle	www.oracle.com/security-alerts/cpuoct2021.html

21 Nov 2024 04:32Current

8.2High risk

Vulners AI Score8.2

CVSS 25

CVSS 3.17.5

EPSS0.00831

CWE-918