CVE-2020-11987

Fixed in a distro release EPSS 13%

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Published 2021-02-24 · CVE record · OSV

Products: apache batik, fedoraproject fedora, oracle agile_engineering_data_management, oracle banking_apis, oracle banking_digital_experience, oracle communications_application_session_controller, oracle communications_metasolv_solution, oracle communications_offline_mediation_controller, oracle enterprise_repository, oracle flexcube_universal_banking, oracle fusion_middleware_mapviewer, oracle instantis_enterprisetrack, oracle insurance_policy_administration, oracle product_lifecycle_analytics, oracle retail_back_office, oracle retail_central_office, oracle retail_order_broker, oracle retail_order_management_system_cloud_service, oracle retail_point-of-service, oracle retail_returns_management, oracle weblogic_server, debian_linux

Fixed upstream

Distro releases