CVE-2019-17566

Published: Nov 12, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected (25)

Products: Apache: Batik · Oracle: Api Gateway, Business Intelligence, Communications Application Session Controller, Communications Metasolv Solution, Communications Offline Mediation Controller, Enterprise Repository, Financial Services Analytical Applications Infrastructure, Fusion Middleware Mapviewer, Hospitality Opera 5, Hyperion Financial Reporting, Instantis Enterprisetrack, Jd Edwards Enterpriseone Tools, Retail Integration Bus, Retail Order Broker, Retail Order Management System Cloud Service, Retail Point Of Service, Retail Returns Management

1 product

17 products

Business Intelligence

Communications Application Session Controller

Communications Metasolv Solution

Communications Offline Mediation Controller

Enterprise Repository

Financial Services Analytical Applications Infrastructure

Fusion Middleware Mapviewer

Hospitality Opera 5

Hyperion Financial Reporting

Instantis Enterprisetrack

Jd Edwards Enterpriseone Tools

Retail Integration Bus

Retail Order Broker

Retail Order Management System Cloud Service

Retail Point Of Service

Retail Returns Management

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Batik	Before 1.13

Configuration B

24 vulnerable

Vulnerable Software	Affected Versions
Oracle Api Gateway	Version 11.1.2.4.0
Oracle Business Intelligence	Version 12.2.1.3.0
Oracle Business Intelligence	Version 12.2.1.4.0
Oracle Business Intelligence	Version 5.5.0.0.0
Oracle Business Intelligence	Version 5.9.0.0.0
Oracle Communications Application Session Controller	Version 3.9m0p2
Oracle Communications Metasolv Solution	From 6.3.0 to 6.3.1
Oracle Communications Offline Mediation Controller	Version 12.0.0.3.0
Oracle Enterprise Repository	Version 11.1.1.7.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.1.0
Oracle Fusion Middleware Mapviewer	Version 12.2.1.4.0
Oracle Hospitality Opera 5	Version 5.5
Oracle Hospitality Opera 5	Version 5.6
Oracle Hyperion Financial Reporting	Version 11.1.2.4
Oracle Hyperion Financial Reporting	Version 11.2.5.0
Oracle Instantis Enterprisetrack	From 17.1 to 17.3
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.4.0
Oracle Jd Edwards Enterpriseone Tools	Version 9.2.4.2
Oracle Retail Integration Bus	Version 15.0.3
Oracle Retail Order Broker	Version 15.0
Oracle Retail Order Broker	Version 16.0
Oracle Retail Order Management System Cloud Service	Version 19.5
Oracle Retail Point Of Service	Version 14.1
Oracle Retail Returns Management	Version 14.1