CVE-2019-17566

Fixed in a distro release EPSS 11%

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Published 2020-11-12 · CVE record · OSV

Products: apache batik, oracle api_gateway, oracle business_intelligence, oracle communications_application_session_controller, oracle communications_metasolv_solution, oracle communications_offline_mediation_controller, oracle enterprise_repository, oracle financial_services_analytical_applications_infrastructure, oracle fusion_middleware_mapviewer, oracle hospitality_opera_5, oracle hyperion_financial_reporting, oracle instantis_enterprisetrack, oracle jd_edwards_enterpriseone_tools, oracle retail_integration_bus, oracle retail_order_broker, oracle retail_order_management_system_cloud_service, oracle retail_point-of-service, oracle retail_returns_management

Fixed upstream

Distro releases