{"id":"CVE-2020-11987","aliases":["CLSA-2026-1778633124","DEBIAN-CVE-2020-11987","DLA-3619-1","DLA-4243-1","EUVD-2022-0426","GHSA-2h63-qp69-fwvw","MGASA-2021-0139","MGASA-2021-0168","OESA-2021-1134","SUSE-SU-2024:0777-1","UBUNTU-CVE-2020-11987","USN-6117-1","openSUSE-SU-2024:12402-1"],"status":"published","title":"Server-side request forgery (SSRF) in Apache Batik","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.13635,"percentile":0.96526,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-918"],"published":"2021-02-24T00:00:00Z","modified":"2026-10-26T12:01:25Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-svgbrowser","fixed_in":["1.14"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.14-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"batik","fixed_in":["1.14-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"batik","fixed_in":["1.10-6.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","fixed_in":["1.7.ubuntu-8ubuntu2.14.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","fixed_in":["1.8-3ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"batik","fixed_in":["1.10-2~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"batik","fixed_in":["1.12-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-svgbrowser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2+deb10u3"}]}],"versions":["1.10-2","1.10-2+deb10u1","1.10-2+deb10u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-4+deb11u3"}]}],"versions":["1.12-4","1.12-4+deb11u1","1.12-4+deb11u2"],"bundled":4},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-svgbrowser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14"}]}],"versions":["1.10","1.11","1.12","1.13","1.9","1.9.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1.3.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-6.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2.7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2","1.7.ubuntu-8ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3ubuntu1+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2~18.04.1"}]}],"versions":["1.9-3","1.10-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1"}]}],"versions":["1.10-2","1.12-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16+dfsg-1","1.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2build1","1.19-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2","1.18+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2","1.7.ubuntu-8ubuntu2.14.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3ubuntu1+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2~18.04.1"}]}],"versions":["1.9-3","1.10-2~18.04"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1"}]}],"versions":["1.10-2","1.12-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1ubuntu0.2"}]}],"versions":["1.12-4","1.14-1"],"bundled":7}],"products":[{"vendor":"apache","product":"batik"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"agile_engineering_data_management"},{"vendor":"oracle","product":"banking_apis"},{"vendor":"oracle","product":"banking_digital_experience"},{"vendor":"oracle","product":"communications_application_session_controller"},{"vendor":"oracle","product":"communications_metasolv_solution"},{"vendor":"oracle","product":"communications_offline_mediation_controller"},{"vendor":"oracle","product":"enterprise_repository"},{"vendor":"oracle","product":"flexcube_universal_banking"},{"vendor":"oracle","product":"fusion_middleware_mapviewer"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"insurance_policy_administration"},{"vendor":"oracle","product":"product_lifecycle_analytics"},{"vendor":"oracle","product":"retail_back_office"},{"vendor":"oracle","product":"retail_central_office"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_order_management_system_cloud_service"},{"vendor":"oracle","product":"retail_point-of-service"},{"vendor":"oracle","product":"retail_returns_management"},{"vendor":"oracle","product":"weblogic_server"}],"references":[{"url":"https://xmlgraphics.apache.org/security.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202401-11","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11987","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/0ef5b661a1f77772d1110877ea9e0287987098f6","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2@%3Cdev.poi.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05@%3Cdev.poi.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/"},{"url":"https://issues.apache.org/jira/browse/BATIK-1284","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2h63-qp69-fwvw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11987","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM","tags":["web"]},{"url":"https://github.com/apache/xmlgraphics-batik","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0139.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28439","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/02/24/2","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0168.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26800","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N3V3MJVGDUNTVPXXGYR335PZJJK7LDXC/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1134","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034675","tags":["report"]},{"url":"https://bugzilla.suse.com/1172961","tags":["report"]},{"url":"https://bugzilla.suse.com/1182748","tags":["report"]},{"url":"https://bugzilla.suse.com/1203672","tags":["report"]},{"url":"https://bugzilla.suse.com/1203673","tags":["report"]},{"url":"https://bugzilla.suse.com/1203674","tags":["report"]},{"url":"https://bugzilla.suse.com/1204704","tags":["report"]},{"url":"https://bugzilla.suse.com/1204709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44730","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-11987","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6117-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-40146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-42890","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-11987","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2021-02-24T00:00:00Z","modified":"2026-10-08T21:14:05.819Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2022-0426","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2021-02-24T00:00:00Z","modified":"2026-10-08T21:14:05Z","updated_at":"2026-11-02T17:27:25.942984Z"}],"ghsa":[{"id":"GHSA-2h63-qp69-fwvw","title":"Server-side request forgery (SSRF) in Apache Batik","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2022-01-06T20:35:54Z","modified":"2024-01-08T15:13:44Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:37:30.183224Z"}],"nvd":[{"id":"CVE-2020-11987","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2021-02-24T18:15:11.093Z","modified":"2026-10-08T22:16:55.817Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-11987","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2021-02-24T18:15:11.093Z","modified":"2026-10-24T10:30:21.189338998Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-11987","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2021-02-24T18:15:11.093Z","modified":"2026-10-26T12:01:25.35838885Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-2h63-qp69-fwvw","title":"Server-side request forgery (SSRF) in Apache Batik","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2022-01-06T20:35:54Z","modified":"2024-03-12T05:18:41.717842Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"OESA-2021-1134","title":"batik security update","description":"Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.\r\n\r\nSecurity Fix(es):\r\n\r\nApache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.(CVE-2020-11987)","status":"published","published":"2021-04-07T11:04:22Z","modified":"2026-08-18T01:15:10.37975317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-11987","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","status":"published","published":"2021-02-24T18:15:00Z","modified":"2026-10-17T12:55:51.344309897Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3619-1","title":"batik - security update","status":"published","published":"2023-10-14T00:00:00Z","modified":"2026-03-09T01:23:12.351122Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4243-1","title":"batik - security update","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-09T02:10:07.441567Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2021-0139","title":"Updated batik packages fix a security vulnerability","description":"The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that\nallow an attacker to cause the underlying server to make arbitrary GET requests\n(CVE-2020-11987).\n","status":"published","published":"2021-03-17T06:16:07Z","modified":"2026-04-16T04:41:45.107216242Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2021-0168","title":"Updated batik packages fix security vulnerabilities","description":"A flaw was found in the Apache Batik library, where it is vulnerable to a\nServer-Side Request Forgery attack (SSRF) via \"xlink:href\" attributes. This\nflaw allows an attacker to cause the underlying server to make arbitrary GET\nrequests. The highest threat from this vulnerability is to system integrity\n(CVE-2019-17566).\n\nThe Apache Batik library is vulnerable to SSRF via the NodePickerPanel that\nallow an attacker to cause the underlying server to make arbitrary GET requests\n(CVE-2020-11987).\n","status":"published","published":"2021-04-02T20:25:05Z","modified":"2026-04-16T04:44:10.152099606Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:12402-1","title":"xmlgraphics-batik-1.15-2.1 on GA media","description":"These are all security issues fixed in the xmlgraphics-batik-1.15-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:58.24333Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2024:0777-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).\n- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).\n- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).\n- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).\n- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).\n- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-06T11:54:24Z","modified":"2026-02-04T03:34:59.610627Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6117-1","title":"batik vulnerabilities","description":"It was discovered that Apache Batik incorrectly handled certain inputs. An\nattacker could possibly use this to perform a cross site request forgery\nattack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)\n\nIt was discovered that Apache Batik incorrectly handled Jar URLs in some\nsituations. A remote attacker could use this issue to access files on the\nserver. (CVE-2022-40146)\n\nIt was discovered that Apache Batik allowed running untrusted Java code from\nan SVG. An attacker could use this issue to cause a denial of service,\nor possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)\n","status":"published","published":"2023-05-30T14:31:05Z","modified":"2026-06-29T13:50:48.321211924Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}