Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade batikUpgrade batik-demoUpgrade batik-svgppUpgrade batik-slideshowUpgrade batik-ttf2svgUpgrade batik-rasterizerUpgrade batik-javadocUpgrade batik-squiggle | Mar 26, 2025 | Aug 22, 2023 |
| Debian | — | Upgrade batik | Oct 16, 2023 | Aug 22, 2023 |
| Gentoo Linux | — | Upgrade dev-java/batik. | Jan 8, 2024 | Aug 22, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 22, 2023 |
| Suse | — | Upgrade xmlgraphics-batik-demoUpgrade xmlgraphics-batikUpgrade xmlgraphics-batik-ttf2svgUpgrade xmlgraphics-batik-cssUpgrade xmlgraphics-batik-rasterizerUpgrade xmlgraphics-batik-squiggleUpgrade xmlgraphics-batik-slideshowUpgrade xmlgraphics-batik-svgppUpgrade xmlgraphics-batik-javadoc | Aug 9, 2024 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub