CVE-2018-8013: apache software foundation apache batik Deserialization of Untrusted Data
Vulnerability summary
CVE-2018-8013 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache batik. EPSS estimates a 18.93% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 24-05-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
18.93%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
-0.36 pp
From 19.29% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle18 products
- business_intelligence11.1.1.7.0 | 11.1.1.9.0 | 12.2.1.3.0 | 12.2.1.4.0
- communications_diameter_signaling_router< 8.3
- communications_metasolv_solution6.3.0
- communications_webrtc_session_controller< 7.2
- data_integrator12.2.1.3.0
Debian2 products
- batik< 1.10-1 | < 1.7+dfsg-3+deb7u3
- debian_linuxEOL7.0 | 8.0 | 9.0
Apache1 product
- batik≥ 1.0, < 1.10
Apache software foundation1 product
- apache batik1.0 - 1.9.1
Canonical1 product
- ubuntu_linuxEOL14.04
Org.apache.xmlgraphics1 product
- batik≥ 1.0, < 1.10
Ubuntu1 product
- batikAll versions (No fix recorded) | < 1.7.ubuntu-8ubuntu2.14.04.3
7 vendors · 25 products
