SSRF (Server-Side Request Forgery) org.apache.xmlgraphics:batik-bridge Dependency in Jira Software Data Center and Server

This High severity org.apache.xmlgraphics:batik-bridge Dependency vulnerability was introduced in versions 8.20.0, 8.22.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Jira Software Data Center and Server. This org.apache.xmlgraphics:batik-bridge Dependency vulnerability, with a CVSS...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (>=1.0.0, <=1.0.1) +1996 more potentially affected by CVE-2022-44729 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.16)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.0, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-44729 Source advisory:...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (>=1.0.0, <=1.0.1) +1623 more potentially affected by CVE-2022-42890 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.15)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.0, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-42890 Source advisory:...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (>=1.0.0, <=1.0.1) +1623 more potentially affected by CVE-2022-42890 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.15)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.0, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-42890 Source advisory: MEND:CVE-2022-428...

Server-Side Request Forgery

org.apache.xmlgraphics:batik-bridge is vulnerable to server-side request forgery. The vulnerability exists in the createImageGraphicsNode function in SVGImageElementBridge.java because the function logic does not properly restrict external resources, which allows remote attackers to cause SSRF...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (1.0.0) +1621 more potentially affected by CVE-2022-38648 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-38648 Source advisory: OSV:GHSA-53JM-3HC9-FQQC...

at.datenwort.openhtmltopdf:openhtmltopdf-latex-support (1.1.3), at.datenwort.openhtmltopdf:openhtmltopdf-mathml-support (1.1.3) +554 more potentially affected by CVE-2022-38398 via org.apache.xmlgraphics:batik-bridge (1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:batik-bridge and may be impacted: - at.datenwort.openhtmltopdf:openhtmltopdf-latex-support 1.1.3 -...