CVE-2019-17566
High
Description
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Batik
PublishedNov 12, 2020
First seenNov 12, 2020
How to fix
Update
- apache batik1.13 or later
- oracle jd_edwards_enterpriseone_tools9.2.4.0 or later
- org.apache.xmlgraphics:batik1.13 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache batik | v < 1.13 | 1.13 |
| oracle api_gateway | 11.1.2.4.0 | — |
| oracle business_intelligence | 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_application_session_controller | 3.9m0p2 | — |
| oracle communications_metasolv_solution | 6.3.0 ≤ v ≤ 6.3.1 | — |
| oracle communications_offline_mediation_controller | 12.0.0.3.0 | — |
| oracle enterprise_repository | 11.1.1.7.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle fusion_middleware_mapviewer | 12.2.1.4.0 | — |
| oracle hospitality_opera_5 | 5.5, 5.6 | — |
| oracle hyperion_financial_reporting | 11.1.2.4, 11.2.5.0 | — |
| oracle instantis_enterprisetrack | 17.1 ≤ v ≤ 17.3 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.4.0, 9.2.4.2 | 9.2.4.0 |
| oracle retail_integration_bus | 15.0.3 | — |
| oracle retail_order_broker | 15.0, 16.0 | — |
| oracle retail_order_management_system_cloud_service | 19.5 | — |
| oracle retail_point-of-service | 14.1 | — |
| oracle retail_returns_management | 14.1 | — |
| org.apache.xmlgraphics:batikMaven | v < 1.13 | 1.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.