Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-batikamazon-linux-ami-2-upgrade-batik-demoamazon-linux-ami-2-upgrade-batik-javadocamazon-linux-ami-2-upgrade-batik-rasterizeramazon-linux-ami-2-upgrade-batik-slideshowamazon-linux-ami-2-upgrade-batik-squiggleamazon-linux-ami-2-upgrade-batik-svgppamazon-linux-ami-2-upgrade-batik-ttf2svg | Mar 26, 2025 | Aug 22, 2023 | |
| Debian | debian-upgrade-batik | Oct 16, 2023 | Aug 22, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-java-batik | Jan 8, 2024 | Aug 22, 2023 | |
| Oracle Missing Cpu Oct 2023 | oracle-apply-oct-2023-cpu | Oct 18, 2023 | Aug 22, 2023 | |
| Oracle Weblogic | oracle-weblogic-oct-2023-cpu-12_2_1_4_0oracle-weblogic-oct-2023-cpu-14_1_1_0_0 | Oct 19, 2023 | Aug 22, 2023 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Aug 22, 2023 |
| Suse | — | suse-upgrade-xmlgraphics-batiksuse-upgrade-xmlgraphics-batik-csssuse-upgrade-xmlgraphics-batik-demosuse-upgrade-xmlgraphics-batik-javadocsuse-upgrade-xmlgraphics-batik-rasterizersuse-upgrade-xmlgraphics-batik-slideshowsuse-upgrade-xmlgraphics-batik-squigglesuse-upgrade-xmlgraphics-batik-svgppsuse-upgrade-xmlgraphics-batik-ttf2svg | Aug 9, 2024 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub