{"id":"CVE-2019-17566","aliases":["CLSA-2026-1778633124","DEBIAN-CVE-2019-17566","EUVD-2022-0963","GHSA-cmx4-p4v5-hmr5","MGASA-2021-0168","SUSE-SU-2020:1800-1","SUSE-SU-2024:0777-1","UBUNTU-CVE-2019-17566","USN-6117-1","openSUSE-SU-2020:0851-1","openSUSE-SU-2020:1043-1","openSUSE-SU-2024:11522-1"],"status":"published","title":"Server-side request forgery (SSRF) in Apache Batik","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.10867,"percentile":0.95918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-918"],"published":"2020-06-22T18:18:29Z","modified":"2026-10-24T10:31:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","fixed_in":["1.13"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.12-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.12-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.12-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"xmlgraphics-batik","fixed_in":["1.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","fixed_in":["1.8-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","fixed_in":["1.7.ubuntu-8ubuntu2.14.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","fixed_in":["1.8-3ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"batik","fixed_in":["1.10-2~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"batik","fixed_in":["1.12-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"xmlgraphics-batik","fixed_in":["1.9-lp151.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"xmlgraphics-batik","fixed_in":["1.9-bp151.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xmgraphics-batik","fixed_in":["1.14-2.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13"}]}],"versions":["1.10","1.11","1.12","1.9.1"]},{"source":"osv","ecosystem":"Mageia:7","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1.3.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2.7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2","1.7.ubuntu-8ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3ubuntu1+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2~18.04.1"}]}],"versions":["1.9-3","1.10-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1"}]}],"versions":["1.10-2","1.12-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2","1.7.ubuntu-8ubuntu2.14.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3ubuntu1+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2~18.04.1"}]}],"versions":["1.9-3","1.10-2~18.04"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1"}]}],"versions":["1.10-2","1.12-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1ubuntu0.2"}]}],"versions":["1.12-4","1.14-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-lp151.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-bp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xmgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-2.5"}]}]}],"products":[{"vendor":"apache","product":"batik"},{"vendor":"oracle","product":"api_gateway"},{"vendor":"oracle","product":"business_intelligence"},{"vendor":"oracle","product":"communications_application_session_controller"},{"vendor":"oracle","product":"communications_metasolv_solution"},{"vendor":"oracle","product":"communications_offline_mediation_controller"},{"vendor":"oracle","product":"enterprise_repository"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"fusion_middleware_mapviewer"},{"vendor":"oracle","product":"hospitality_opera_5"},{"vendor":"oracle","product":"hyperion_financial_reporting"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools"},{"vendor":"oracle","product":"retail_integration_bus"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_order_management_system_cloud_service"},{"vendor":"oracle","product":"retail_point-of-service"},{"vendor":"oracle","product":"retail_returns_management"}],"references":[{"url":"https://xmlgraphics.apache.org/security.html","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171%40%3Ccommits.myfaces.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509%40%3Ccommits.myfaces.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.gentoo.org/glsa/202401-11","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17566","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/bc6078ca949039e2076cd08b4cb169c84c1179b1","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/BATIK-1276","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171@%3Ccommits.myfaces.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509@%3Ccommits.myfaces.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cmx4-p4v5-hmr5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17566","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0168.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26800","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/02/24/2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N3V3MJVGDUNTVPXXGYR335PZJJK7LDXC/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201800-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172961","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17566","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034675","tags":["report"]},{"url":"https://bugzilla.suse.com/1182748","tags":["report"]},{"url":"https://bugzilla.suse.com/1203672","tags":["report"]},{"url":"https://bugzilla.suse.com/1203673","tags":["report"]},{"url":"https://bugzilla.suse.com/1203674","tags":["report"]},{"url":"https://bugzilla.suse.com/1204704","tags":["report"]},{"url":"https://bugzilla.suse.com/1204709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44730","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17566","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/15/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6117-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-40146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-42890","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H26W7GQ5JCRMNMV6QRWEGLVRZVIXK3RB/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JIOZHMTGG4ETJEMBNIT3YKEQUXO3JNEJ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2020-11-12T00:00:00Z","modified":"2024-08-05T01:40:15.834Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2022-0963","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2020-11-12T00:00:00Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-cmx4-p4v5-hmr5","title":"Server-side request forgery (SSRF) in Apache Batik","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2022-02-09T00:46:46Z","modified":"2024-01-08T15:13:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:37:30.183224Z"}],"nvd":[{"id":"CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2020-11-12T18:15:12.567Z","modified":"2026-06-17T02:24:10.36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2020-11-12T18:15:12.567Z","modified":"2026-10-24T10:31:03.89996294Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2020-11-12T18:15:12.567Z","modified":"2026-09-21T07:03:08.515101109Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-cmx4-p4v5-hmr5","title":"Server-side request forgery (SSRF) in Apache Batik","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2022-02-09T00:46:46Z","modified":"2024-02-16T08:14:56.668102Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2020-11-12T18:15:00Z","modified":"2026-02-04T03:47:04.631542Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2021-0168","title":"Updated batik packages fix security vulnerabilities","description":"A flaw was found in the Apache Batik library, where it is vulnerable to a\nServer-Side Request Forgery attack (SSRF) via \"xlink:href\" attributes. This\nflaw allows an attacker to cause the underlying server to make arbitrary GET\nrequests. The highest threat from this vulnerability is to system integrity\n(CVE-2019-17566).\n\nThe Apache Batik library is vulnerable to SSRF via the NodePickerPanel that\nallow an attacker to cause the underlying server to make arbitrary GET requests\n(CVE-2020-11987).\n","status":"published","published":"2021-04-02T20:25:05Z","modified":"2026-04-16T04:44:10.152099606Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:0851-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-06-22T18:18:29Z","modified":"2026-02-04T03:07:44.050988Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:1043-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-07-23T10:21:43Z","modified":"2026-02-04T03:23:23.396849Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11522-1","title":"xmlgraphics-batik-1.14-2.5 on GA media","description":"These are all security issues fixed in the xmlgraphics-batik-1.14-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:10:52.914522Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:1800-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961).\n","status":"published","published":"2020-06-30T09:50:41Z","modified":"2026-02-04T02:46:32.633975Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2024:0777-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).\n- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).\n- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).\n- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).\n- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).\n- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-06T11:54:24Z","modified":"2026-02-04T03:34:59.610627Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6117-1","title":"batik vulnerabilities","description":"It was discovered that Apache Batik incorrectly handled certain inputs. An\nattacker could possibly use this to perform a cross site request forgery\nattack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)\n\nIt was discovered that Apache Batik incorrectly handled Jar URLs in some\nsituations. A remote attacker could use this issue to access files on the\nserver. (CVE-2022-40146)\n\nIt was discovered that Apache Batik allowed running untrusted Java code from\nan SVG. An attacker could use this issue to cause a denial of service,\nor possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)\n","status":"published","published":"2023-05-30T14:31:05Z","modified":"2026-06-29T13:50:48.321211924Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}