{"id":"CVE-2022-44730","aliases":["CLSA-2025-1764202057","CLSA-2026-1781052741","CLSA-2026-1781571266","DEBIAN-CVE-2022-44730","DLA-3619-1","EUVD-2023-2182","GHSA-2474-2566-3qxp","OESA-2023-1651","SUSE-SU-2024:0777-1","SUSE-SU-2024:0808-1","UBUNTU-CVE-2022-44730","openSUSE-SU-2024:13743-1"],"status":"published","title":"Apache XML Graphics Batik: Information disclosure vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0077,"percentile":0.56061,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2023-08-22T13:57:00Z","modified":"2026-11-03T08:03:09Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-script","fixed_in":["1.17"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","fixed_in":["1.8-tuxcare.2","1.7-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.16+dfsg-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.17+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.17+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8-tuxcare.2"}]}],"versions":["1.8","1.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.2"}]}],"versions":["1.7","1.7-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16+dfsg-1+deb12u1"}]}],"versions":["1.16+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2+deb10u3"}]}],"versions":["1.10-2","1.10-2+deb10u1","1.10-2+deb10u2"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.17"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.6.1","1.7","1.8","1.9","1.9.1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2.7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-150200.4.7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-150200.4.7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1","1.8-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9-3","1.10-2~18.04","1.10-2~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2","1.12-1","1.12-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12-4","1.14-1","1.14-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16+dfsg-1","1.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2build1","1.19-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2","1.18+dfsg-2build1"]}],"products":[{"vendor":"apache","product":"xml_graphics_batik"},{"vendor":"apache software foundation","product":"apache xml graphics batik"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://xmlgraphics.apache.org/security.html","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/08/22/3","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/08/22/5","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html","tags":["x_transferred","Mailing List","article","web"]},{"url":"https://security.gentoo.org/glsa/202401-11","tags":["x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44730","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/f9ae69233eadfbd392a4a08a55618f97343b467c","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/BATIK-1347","tags":["web","report"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/64658ccda90deaf6bf5f5b4d4a2ec365fe648bfa","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2474-2566-3qxp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-44730","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44729","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034675","tags":["report"]},{"url":"https://bugzilla.suse.com/1172961","tags":["report"]},{"url":"https://bugzilla.suse.com/1182748","tags":["report"]},{"url":"https://bugzilla.suse.com/1203672","tags":["report"]},{"url":"https://bugzilla.suse.com/1203673","tags":["report"]},{"url":"https://bugzilla.suse.com/1203674","tags":["report"]},{"url":"https://bugzilla.suse.com/1204704","tags":["report"]},{"url":"https://bugzilla.suse.com/1204709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44730","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240808-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-44730","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/08/22/3","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44730","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-44730","title":"Apache XML Graphics Batik: Information disclosure vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T13:57:00.282Z","modified":"2025-02-13T16:33:42.755Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2023-2182","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T13:57:00Z","modified":"2025-02-13T16:33:42Z","updated_at":"2026-11-03T00:03:52.297177Z"}],"ghsa":[{"id":"GHSA-2474-2566-3qxp","title":"Apache Batik information disclosure vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T21:30:26Z","modified":"2025-02-13T19:10:28Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2022-44730","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T19:16:29.93Z","modified":"2026-11-10T12:10:00.177Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-10T14:19:22.611066Z"}],"osv":[{"id":"CVE-2022-44730","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T19:16:29.93Z","modified":"2026-03-15T22:46:11.192538Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-44730","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.  A malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T19:16:29.93Z","modified":"2026-11-11T09:47:38.844131428Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T10:35:40.696585Z"},{"id":"GHSA-2474-2566-3qxp","title":"Apache Batik information disclosure vulnerability","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T21:30:26Z","modified":"2025-02-13T19:37:07.622415Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"OESA-2023-1651","title":"batik security update","description":"Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup,  that lets you write your template directly as a CoffeeScript function.\r\n\r\nSecurity Fix(es):\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38398)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38648)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-40146)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\r\n\r\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.\r\n\r\n(CVE-2022-44729)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\r\n\r\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.\r\n\r\n(CVE-2022-44730)","status":"published","published":"2023-09-15T11:06:06Z","modified":"2026-08-18T01:16:36.941225638Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2022-44730","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-10-17T12:56:22.772039676Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"CLSA-2025-1764202057","title":"TuxCare security update for org.apache.velocity:velocity (1 CVE)","description":"TuxCare rebuilt org.apache.velocity:velocity to address 1 CVE. Fixed in 1.7-tuxcare.2.","status":"withdrawn","published":"2026-08-04T14:52:06Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1781052741","title":"TuxCare security update for org.apache.xmlgraphics:batik-script (1 CVE)","description":"TuxCare rebuilt org.apache.xmlgraphics:batik-script to address 1 CVE. Fixed in 1.8-tuxcare.2.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-11-02T19:45:35.415648099Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1781571266","title":"TuxCare security update for org.apache.xmlgraphics:batik-script (1 CVE)","description":"TuxCare rebuilt org.apache.xmlgraphics:batik-script to address 1 CVE. Fixed in 1.7-tuxcare.2.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-11-02T19:45:36.867616352Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"DLA-3619-1","title":"batik - security update","status":"published","published":"2023-10-14T00:00:00Z","modified":"2026-03-09T01:23:12.351122Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:13743-1","title":"xmlgraphics-batik-1.17-1.1 on GA media","description":"These are all security issues fixed in the xmlgraphics-batik-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:38.395955Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0777-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).\n- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).\n- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).\n- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).\n- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).\n- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-06T11:54:24Z","modified":"2026-02-04T03:34:59.610627Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0808-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-07T19:46:57Z","modified":"2026-02-04T03:56:32.934201Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}