CVE-2022-44730

Published: Aug 22, 2023Modified: Feb 13, 2025

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 1.8 / Impact: 2.5

Source: NVD

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

Affected (2)

Products: Apache: Xml Graphics Batik · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xml Graphics Batik	From 1.0 to 1.16

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (12)

http://www.openwall.com/lists/oss-security/2023/08/22/3

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/08/22/5

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html

Source: security@apache.org

Mailing List

https://security.gentoo.org/glsa/202401-11

Source: security@apache.org

https://xmlgraphics.apache.org/security.html

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2023/08/22/3