CVSS 7.5 · High EPSS 10,9%
Kerentanan Server-Side Request Forgery (SSRF) pada apache batik, oracle api gateway +16 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| apache | batik | Semua versi sebelum 1.13 |
| oracle | api gateway | Versi 11.1.2.4.0 |
| oracle | business intelligence | Versi 5.5.0.0.0 |
| oracle | business intelligence | Versi 5.9.0.0.0 |
| oracle | business intelligence | Versi 12.2.1.3.0 |
| oracle | business intelligence | Versi 12.2.1.4.0 |
| oracle | communications application session controller | Versi 3.9m0p2 |
| oracle | communications metasolv solution | Versi 6.3.0 hingga 6.3.1 |
| oracle | communications offline mediation controller | Versi 12.0.0.3.0 |
| oracle | enterprise repository | Versi 11.1.1.7.0 |
| oracle | financial services analytical applications infrastructure | Versi 8.0.6 hingga 8.1.0 |
| oracle | fusion middleware mapviewer | Versi 12.2.1.4.0 |
| oracle | hospitality opera 5 | Versi 5.5 |
| oracle | hospitality opera 5 | Versi 5.6 |
| oracle | hyperion financial reporting | Versi 11.1.2.4 |
| oracle | hyperion financial reporting | Versi 11.2.5.0 |
| oracle | instantis enterprisetrack | Versi 17.1 hingga 17.3 |
| oracle | jd edwards enterpriseone tools | Semua versi sebelum 9.2.4.0 |
| oracle | jd edwards enterpriseone tools | Versi 9.2.4.2 |
| oracle | retail integration bus | Versi 15.0.3 |
| oracle | retail order broker | Versi 15.0 |
| oracle | retail order broker | Versi 16.0 |
| oracle | retail order management system cloud service | Versi 19.5 |
| oracle | retail point-of-service | Versi 14.1 |
| oracle | retail returns management | Versi 14.1 |