CVE-2020-11987

Published: Feb 24, 2021Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: NVD

Description

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected (37)

Products: Apache: Batik · Fedoraproject: Fedora · Oracle: Agile Engineering Data Management, Banking Apis, Banking Digital Experience, Communications Application Session Controller, Communications Metasolv Solution, Communications Offline Mediation Controller, Enterprise Repository, Flexcube Universal Banking, Fusion Middleware Mapviewer, Instantis Enterprisetrack, Insurance Policy Administration, Product Lifecycle Analytics, Retail Back Office, Retail Central Office, Retail Order Broker, Retail Order Management System Cloud Service, Retail Point Of Service, Retail Returns Management, Weblogic Server · +1 more

Show all products

1 product

1 product

19 products

Agile Engineering Data Management

Banking Apis

Banking Digital Experience

Communications Application Session Controller

Communications Metasolv Solution

Communications Offline Mediation Controller

Enterprise Repository

Flexcube Universal Banking

Fusion Middleware Mapviewer

Instantis Enterprisetrack

Insurance Policy Administration

Product Lifecycle Analytics

Retail Back Office

Retail Central Office

Retail Order Broker

Retail Order Management System Cloud Service

Retail Point Of Service

Retail Returns Management

Weblogic Server

Debian

1 product

Debian Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Batik	Up to 1.13

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration C

33 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.2.1.0
Oracle Banking Apis	Version 18.3
Oracle Banking Apis	Version 19.1
Oracle Banking Apis	Version 19.2
Oracle Banking Apis	Version 20.1
Oracle Banking Apis	Version 21.1
Oracle Banking Digital Experience	Version 18.3
Oracle Banking Digital Experience	Version 19.1
Oracle Banking Digital Experience	Version 19.2
Oracle Banking Digital Experience	Version 20.1
Oracle Banking Digital Experience	Version 21.1
Oracle Communications Application Session Controller	Version 3.9m0p3
Oracle Communications Metasolv Solution	Version 6.3.0
Oracle Communications Metasolv Solution	Version 6.3.1
Oracle Communications Offline Mediation Controller	Version 12.0.0.3.0
Oracle Enterprise Repository	Version 11.1.1.7.0
Oracle Flexcube Universal Banking	From 14.1.0 to 14.4.0
Oracle Fusion Middleware Mapviewer	Version 12.2.1.4.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Insurance Policy Administration	From 11.0 to 11.3.1
Oracle Product Lifecycle Analytics	Version 3.6.1
Oracle Retail Back Office	Version 14.1
Oracle Retail Central Office	Version 14.1
Oracle Retail Order Broker	Version 15.0
Oracle Retail Order Broker	Version 16.0
Oracle Retail Order Management System Cloud Service	Version 19.5
Oracle Retail Point Of Service	Version 14.1
Oracle Retail Returns Management	Version 14.1
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0