CVE-2022-44730

CVE	CVE-2022-44730
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-08-22 19:16:00 UTC
Updated	2024-01-07 11:15:00 UTC
Description	Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

Problem Types: CWE-918

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Xml Graphics Batik	All	All	All	All
Operating System	Debian	Debian Linux	10.0	All	All	All

Reference	Source	Link	Tags
[SECURITY] [DLA 3619-1] batik security update	MISC	lists.debian.org
lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0	MISC	lists.apache.org
oss-security - [CVE-2022-44730] Apache Batik information disclosure vulnerability	MISC	www.openwall.com
security.gentoo.org/glsa/202401-11		security.gentoo.org
The Apache(tm) XML Graphics Project - Community	MISC	xmlgraphics.apache.org
oss-security - Re: [CVE-2022-44730] Apache Batik information disclosure vulnerability	MISC	www.openwall.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

379090 IBM QRadar SIEM Multiple Security Vulnerabilities (7070736)
6000250 Debian Security Update for batik (DLA 3619-1)
710829 Gentoo Linux Apache Batik Multiple Vulnerabilities (GLSA 202401-11)
755916 SUSE Enterprise Linux Security Update for xmlgraphics-batik (SUSE-SU-2024:0777-1)
755935 SUSE Enterprise Linux Security Update for xmlgraphics-batik (SUSE-SU-2024:0808-1)
994979 Java (Maven) Security Update for org.apache.xmlgraphics:batik-script (GHSA-2474-2566-3qxp)