Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

Remediation

References

http://www.openwall.com/lists/oss-security/2023/08/22/2

http://www.openwall.com/lists/oss-security/2023/08/22/4

https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2

https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html

https://security.gentoo.org/glsa/202401-11

https://xmlgraphics.apache.org/security.html

Related Vulnerabilities

CVE-2022-23640 Vulnerability in maven package com.monitorjbl:xlsx-streamer

CVE-2020-15242 Vulnerability in npm package next

CVE-2020-5258 Vulnerability in maven package org.webjars.bowergithub.dojo:dojo

CVE-2019-20444 Vulnerability in maven package io.netty:netty-codec-http

CVE-2020-7720 Vulnerability in npm package node-forge

Severity

High

Classification

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory NVD-CWE-noinfo