NetSight
IP …
high8.2

CVE-2020-11987

Server-side request forgery (SSRF) in Apache Batik

Impact

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.xmlgraphics:batik-svgbrowser< 1.141.14

Affected products

VendorProductAffected versions
ApacheBatik
through 1.13
FedoraprojectFedora
Versions 33, 34
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleBanking Apis
Versions 18.3, 19.1, 19.2, 20.1, 21.1
OracleBanking Digital Experience
Versions 18.3, 19.1, 19.2, 20.1, 21.1
OracleCommunications Application Session Controller
Version 3.9m0p3
OracleCommunications Metasolv Solution
Versions 6.3.0, 6.3.1
OracleCommunications Offline Mediation Controller
Version 12.0.0.3.0
OracleEnterprise Repository
Version 11.1.1.7.0
OracleFlexcube Universal Banking
from 14.1.0 through 14.4.0
OracleFusion Middleware Mapviewer
Version 12.2.1.4.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3

Weakness classification

CWE-20CWE-918

References