Log in Start free

Vulnerability · Published Feb 24, 2021 · Assigned by apache

CVE-2020-11987

High 8.2

In plain English

A high-severity security flaw in Apache Batik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.6% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.2High
Exploit odds (30 days)13.6%top 3.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12batik1.14-1DEBIAN-CVE-2020-11987
Debian:13batik1.14-1DEBIAN-CVE-2020-11987
Debian:14batik1.14-1DEBIAN-CVE-2020-11987
Mavenorg.apache.xmlgraphics:batik-svgbrowser1.14GHSA-2h63-qp69-fwvw
Ubuntu:22.04:LTSbatik1.14-1ubuntu0.2USN-6117-1
Ubuntu:24.04:LTSbatikno fix listedUBUNTU-CVE-2020-11987
Ubuntu:25.10batikno fix listedUBUNTU-CVE-2020-11987
Ubuntu:26.04:LTSbatikno fix listedUBUNTU-CVE-2020-11987
Ubuntu:26.10batikno fix listedUBUNTU-CVE-2020-11987

Affected products (as reported)

VendorProductVersions
n/a Apache Batik Apache Batik 1.13

References