CVE-2019-17566: apache batik Server-Side Request Forgery (SSRF)
CVSS: 7.5v3.1HighModified
AliasesSUSE-SU-2020:1800-1openSUSE-SU-2020:1043-1UBUNTU-CVE-2019-17566DEBIAN-CVE-2019-17566openSUSE-SU-2020:0851-1openSUSE-SU-2024:11522-1GHSA-cmx4-p4v5-hmr5
Published 12-11-2020Last modified 05-08-2024
Vulnerability summary
CVE-2019-17566 is a high (CVSS 7.5) Server-Side Request Forgery (SSRF) vulnerability in apache batik. EPSS estimates a 10.87% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
10.87%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 12-11-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
10.87%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.87% on 18-09-2026
18-09-202618-10-2026
EPSS score10.87%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle17 products
- api_gateway11.1.2.4.0
- business_intelligence5.5.0.0.0 | 5.9.0.0.0 | 12.2.1.3.0 | 12.2.1.4.0
- communications_application_session_controller3.9m0p2
- communications_metasolv_solution≥ 6.3.0, ≤ 6.3.1
- communications_offline_mediation_controller12.0.0.3.0
Suse3 products
- xmlgraphics-batik&distro=SUSE Linux Enterprise Software Development Kit 12 SP4< 1.8-3.3.1
- xmlgraphics-batik&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.8-3.3.1
- xmlgraphics-batik&distro=SUSE Package Hub 15 SP1< 1.9-bp151.2.3.1
Opensuse2 products
- xmgraphics-batik&distro=openSUSE Tumbleweed< 1.14-2.5
- xmlgraphics-batik&distro=openSUSE Leap 15.1< 1.9-lp151.6.3.1
Apache1 product
- batik< 1.13
Debian1 product
- batik< 1.12-1.1
Org.apache.xmlgraphics1 product
- batik< 1.13
Ubuntu1 product
- batik< 1.7.ubuntu-8ubuntu2.14.04.3+esm1 | < 1.8-3ubuntu1+esm1 | < 1.10-2~18.04.1 | < 1.12-1ubuntu0.1
7 vendors · 26 products
References
26 linksShow all 26 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
