Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2019-17566
HistoryNov 12, 2020 - 6:15 p.m.

CVE-2019-17566

2020-11-1218:15:12
CWE-918
[email protected]
web.nvd.nist.gov
2

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.5%

JSON

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the “xlink:href” attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected configurations

NVD
Node
apachebatikRange<1.13
Node
oracleapi_gatewayMatch11.1.2.4.0
OR
oraclebusiness_intelligenceMatch5.5.0.0.0enterprise
OR
oraclebusiness_intelligenceMatch5.9.0.0.0enterprise
OR
oraclebusiness_intelligenceMatch12.2.1.3.0enterprise
OR
oraclebusiness_intelligenceMatch12.2.1.4.0enterprise
OR
oraclecommunications_application_session_controllerMatch3.9m0p2
OR
oraclecommunications_metasolv_solutionRange6.3.0–6.3.1
OR
oraclecommunications_offline_mediation_controllerMatch12.0.0.3.0
OR
oracleenterprise_repositoryMatch11.1.1.7.0
OR
oraclefinancial_services_analytical_applications_infrastructureRange8.0.6–8.1.0
OR
oraclefusion_middleware_mapviewerMatch12.2.1.4.0
OR
oraclehospitality_opera_5Match5.5
OR
oraclehospitality_opera_5Match5.6
OR
oraclehyperion_financial_reportingMatch11.1.2.4
OR
oraclehyperion_financial_reportingMatch11.2.5.0
OR
oracleinstantis_enterprisetrackRange17.1–17.3
OR
oraclejd_edwards_enterpriseone_toolsRange<9.2.4.0
OR
oraclejd_edwards_enterpriseone_toolsMatch9.2.4.2
OR
oracleretail_integration_busMatch15.0.3
OR
oracleretail_order_brokerMatch15.0
OR
oracleretail_order_brokerMatch16.0
OR
oracleretail_order_management_system_cloud_serviceMatch19.5
OR
oracleretail_point-of-serviceMatch14.1
OR
oracleretail_returns_managementMatch14.1

Related

nessus 11
ibm 38
cvelist 1
redhatcve 1
debiancve 1
ubuntucve 1
cve 1
veracode 1
suse 2
prion 1
osv 3
openvas 18
github 1
fedora 15
mageia 1
rosalinux 1
ubuntu 1
gentoo 1
redhat 3
oracle 6
nessus
nessus
IBM WebSphere Application Server 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.18 / 9.0.x < 9.0.5.5 SSRF (CVE-2019-17566)
2020-10-30 00:00:00
openSUSE Security Update : xmlgraphics-batik (openSUSE-2020-851)
2020-07-20 00:00:00
Fedora 32 : 1:ecj / 1:eclipse / 1:eclipse-emf / 2:eclipse-cdt / batik / etc (2020-cf8ef2f333)
2020-09-01 00:00:00
ibm
ibm
Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to CVE-2019-17566
2020-11-10 14:05:35
Security Bulletin: Vulnerability in Apache Batik affects WebSphere Application Server (CVE-2019-17566)
2020-08-25 21:46:45
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Business Monitor (CVE-2019-17566)
2020-08-27 07:16:21
cvelist
cvelist
CVE-2019-17566
2020-11-12 00:00:00
redhatcve
redhatcve
CVE-2019-17566
2020-06-18 15:55:19
debiancve
debiancve
CVE-2019-17566
2020-11-12 18:15:12
ubuntucve
ubuntucve
CVE-2019-17566
2020-11-12 00:00:00
cve
cve
CVE-2019-17566
2020-11-12 18:15:12
veracode
veracode
Server-side Request Forgery (SSRF)
2020-06-16 09:19:33
suse
suse
Security update for xmlgraphics-batik (moderate)
2020-06-23 00:00:00
Security update for xmlgraphics-batik (moderate)
2020-07-23 00:00:00
prion
prion
Server side request forgery (ssrf)
2020-11-12 18:15:00
osv
osv
CVE-2019-17566
2020-11-12 18:15:12
Server-side request forgery (SSRF) in Apache Batik
2022-02-09 00:46:46
batik vulnerabilities
2023-05-30 14:31:05
openvas
openvas
openSUSE: Security Advisory for xmlgraphics-batik (openSUSE-SU-2020:0851-1)
2020-06-23 00:00:00
Fedora: Security Advisory for eclipse (FEDORA-2020-cf8ef2f333)
2020-09-02 00:00:00
Fedora: Security Advisory for ecj (FEDORA-2020-cf8ef2f333)
2020-09-02 00:00:00
github
github
Server-side request forgery (SSRF) in Apache Batik
2022-02-09 00:46:46
fedora
fedora
[SECURITY] Fedora 32 Update: eclipse-m2e-core-1.16.1-1.fc32
2020-08-31 15:50:29
[SECURITY] Fedora 32 Update: eclipse-mpc-1.8.3-2.fc32
2020-08-31 15:50:29
[SECURITY] Fedora 32 Update: eclipse-ecf-3.14.8-4.fc32
2020-08-31 15:50:28
mageia
mageia
Updated batik packages fix security vulnerabilities
2021-04-02 23:25:05
rosalinux
rosalinux
Advisory ROSA-SA-2023-2239
2023-10-10 08:57:57
ubuntu
ubuntu
Apache Batik vulnerabilities
2023-05-30 00:00:00
gentoo
gentoo
Apache Batik: Multiple Vulnerabilities
2024-01-07 00:00:00
redhat
redhat
(RHSA-2020:4961) Moderate: Red Hat Process Automation Manager 7.9.0 security update
2020-11-05 18:44:42
(RHSA-2020:4960) Moderate: Red Hat Decision Manager 7.9.0 security update
2020-11-05 18:43:06
(RHSA-2020:5568) Important: Red Hat Fuse 7.8.0 release and security update
2020-12-16 12:07:05
oracle
oracle
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00
Oracle Critical Patch Update Advisory - January 2021
2021-01-19 00:00:00
Oracle Critical Patch Update Advisory - July 2021
2021-07-20 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.5%

JSON
Related for NVD:CVE-2019-17566
nessus11ibm38cvelist1redhatcve1debiancve1ubuntucve1cve1veracode1suse2prion1osv3openvas18github1fedora15mageia1rosalinux1ubuntu1gentoo1redhat3oracle6