Log in Start free

Vulnerability · Published Aug 22, 2023 · Assigned by apache

CVE-2022-44729Apache XML Graphics Batik: Information disclosure vulnerability

High 7.1

In plain English

A high-severity server-side request forgery in Apache XML Graphics Batik from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.1High
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12batik1.16+dfsg-1+deb12u1DEBIAN-CVE-2022-44729
Debian:13batik1.17+dfsg-1DEBIAN-CVE-2022-44729
Debian:14batik1.17+dfsg-1DEBIAN-CVE-2022-44729
Mavenorg.apache.xmlgraphics:batik-bridge1.17GHSA-gq5f-xv48-2365
Mavenorg.apache.xmlgraphics:batik-svgrasterizer1.17GHSA-gq5f-xv48-2365
Mavenorg.apache.xmlgraphics:batik-transcoder1.17GHSA-gq5f-xv48-2365
Ubuntu:22.04:LTSbatikno fix listedUBUNTU-CVE-2022-44729
Ubuntu:24.04:LTSbatikno fix listedUBUNTU-CVE-2022-44729
Ubuntu:25.10batikno fix listedUBUNTU-CVE-2022-44729
Ubuntu:26.04:LTSbatikno fix listedUBUNTU-CVE-2022-44729
Ubuntu:26.10batikno fix listedUBUNTU-CVE-2022-44729

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache XML Graphics Batik 1.16

Weakness: CWE-918

References