CVE-2020-11987

apache batik, fedoraproject fedora, oracle agile engineering data management +19 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-11987

Katalog CVE

CVSS 8.2 · High EPSS 13,3%

Kerentanan Improper Input Validation pada apache batik, fedoraproject fedora +20 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Rincian

Terbit di NVD
24 Februari 2021
Terakhir diubah
8 Oktober 2026
Status NVD
Modified
CVSS 3.1
8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari)
13,3% peluang dieksploitasi; lebih tinggi dari 96,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache batik Semua versi hingga 1.13
fedoraproject fedora Versi 33
fedoraproject fedora Versi 34
oracle agile engineering data management Versi 6.2.1.0
oracle banking apis Versi 18.3
oracle banking apis Versi 19.1
oracle banking apis Versi 19.2
oracle banking apis Versi 20.1
oracle banking apis Versi 21.1
oracle banking digital experience Versi 18.3
oracle banking digital experience Versi 19.1
oracle banking digital experience Versi 19.2
oracle banking digital experience Versi 20.1
oracle banking digital experience Versi 21.1
oracle communications application session controller Versi 3.9m0p3
oracle communications metasolv solution Versi 6.3.0
oracle communications metasolv solution Versi 6.3.1
oracle communications offline mediation controller Versi 12.0.0.3.0
oracle enterprise repository Versi 11.1.1.7.0
oracle flexcube universal banking Versi 14.1.0 hingga 14.4.0
oracle fusion middleware mapviewer Versi 12.2.1.4.0
oracle instantis enterprisetrack Versi 17.1
oracle instantis enterprisetrack Versi 17.2
oracle instantis enterprisetrack Versi 17.3
oracle insurance policy administration Versi 11.0 hingga 11.3.1
oracle product lifecycle analytics Versi 3.6.1
oracle retail back office Versi 14.1
oracle retail central office Versi 14.1
oracle retail order broker Versi 15.0
oracle retail order broker Versi 16.0
oracle retail order management system cloud service Versi 19.5
oracle retail point-of-service Versi 14.1
oracle retail returns management Versi 14.1
oracle weblogic server Versi 12.2.1.3.0
oracle weblogic server Versi 12.2.1.4.0
oracle weblogic server Versi 14.1.1.0.0
debian debian linux Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.