NetSight
IP …
high7.5

CVE-2019-17566

Server-side request forgery (SSRF) in Apache Batik

Impact

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.xmlgraphics:batik< 1.131.13

Affected products

VendorProductAffected versions
ApacheBatik
before 1.13
OracleApi Gateway
Version 11.1.2.4.0
OracleBusiness Intelligence
Versions 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Application Session Controller
Version 3.9m0p2
OracleCommunications Metasolv Solution
from 6.3.0 through 6.3.1
OracleCommunications Offline Mediation Controller
Version 12.0.0.3.0
OracleEnterprise Repository
Version 11.1.1.7.0
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6 through 8.1.0
OracleFusion Middleware Mapviewer
Version 12.2.1.4.0
OracleHospitality Opera 5
Versions 5.5, 5.6
OracleHyperion Financial Reporting
Versions 11.1.2.4, 11.2.5.0
OracleInstantis Enterprisetrack
from 17.1 through 17.3

Weakness classification

CWE-918CWE-20

References