vulnerability

IBM WebSphere Application Server: CVE-2019-17566: Vulnerability in Apache Batik affects WebSphere Application Server (CVE-2019-17566)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:N)

Published

Nov 12, 2020

Added

Nov 12, 2020

Modified

Jun 24, 2026

Description

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the xlink:href attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests

Solution

ibm-was-upgrade-latest

References

CVE-2019-17566
https://attackerkb.com/topics/CVE-2019-17566
IBM-ibm106322683
https://www.ibm.com/support/pages/node/6322683
https://www.cve.org/CVERecord?id=CVE-2019-17566
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0963
CWE-918
EUVD-EUVD-2022-0963

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report