Vulnerability · Published Aug 22, 2023 · Assigned by apache

CVE-2022-44730Apache XML Graphics Batik: Information disclosure vulnerability

Medium 4.4

In plain English

A medium-severity server-side request forgery in Apache XML Graphics Batik from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.4Medium

Exploit odds (30 days)0.9%top 40.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	batik	1.16+dfsg-1+deb12u1	DEBIAN-CVE-2022-44730
Debian:13	batik	1.17+dfsg-1	DEBIAN-CVE-2022-44730
Debian:14	batik	1.17+dfsg-1	DEBIAN-CVE-2022-44730
Maven	org.apache.xmlgraphics:batik-script	1.17	GHSA-2474-2566-3qxp
Ubuntu:22.04:LTS	batik	no fix listed	UBUNTU-CVE-2022-44730
Ubuntu:24.04:LTS	batik	no fix listed	UBUNTU-CVE-2022-44730
Ubuntu:25.10	batik	no fix listed	UBUNTU-CVE-2022-44730
Ubuntu:26.04:LTS	batik	no fix listed	UBUNTU-CVE-2022-44730
Ubuntu:26.10	batik	no fix listed	UBUNTU-CVE-2022-44730

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache XML Graphics Batik	1.16

Weakness: CWE-918

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References