CVE-2022-38648

2022-09-2215:15:09

CWE-918

[email protected]

web.nvd.nist.gov

cve

2022

38648

ssrf

apache

batik

nvd

vulnerability

security

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.1 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.4%

JSON

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Affected configurations

NVD

Node

apachebatikMatch1.14

Node

debiandebian_linuxMatch10.0

CPENameOperatorVersion
apache:batikapache batikeq1.14

CPE	Name	Operator	Version
apache:batik	apache batik	eq	1.14

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache XML Graphics",
    "versions": [
      {
        "version": "Batik 1.14",
        "status": "affected"
      }
    ]
  }
]