CVE-2022-44729

Katalog CVE

CVSS 7.1 · High EPSS 0,92%

Kerentanan Server-Side Request Forgery (SSRF) pada apache xml graphics batik, debian linux. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

Rincian

Terbit di NVD

22 Agustus 2023

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 mailing list · advisory vendor
• https://xmlgraphics.apache.org/security.html advisory vendor
• http://www.openwall.com/lists/oss-security/2023/08/22/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/08/22/4 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html mailing list
• https://security.gentoo.org/glsa/202401-11