Information Disclosure Through Embedded Batik Jar

Apache FOP is vulnerable to information disclosure. This is because of an embedded batik jar in this library. Apache batik is vulnerable to information disclosure through external XML entity (XXE). A malicious user can send a SVG file to the application to cause an XXE to reveal information in sensitive files. The XXE can also be used to trigger a XML entity expansion to consume all the system’s memory, crashing it and causing a denial of service (DoS) condition.