CVE-2022-38398: apache software foundation apache xml graphics Server-Side Request Forgery (SSRF)

CVSS: 5.3v3.1MediumModified

AliasesUBUNTU-CVE-2022-38398DEBIAN-CVE-2022-38398GHSA-c5xv-qc8p-mh2v

Published 22-09-2022Last modified 03-11-2025

Vulnerability summary

CVE-2022-38398 is a medium (CVSS 5.3) Server-Side Request Forgery (SSRF) vulnerability in apache software foundation apache xml graphics. EPSS estimates a 2.58% chance of exploitation in the next 30 days, higher than 84.9% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (NVD)

EPSS score

2.58%

0%100%

Low · +0.45 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 2

DLA-3619-1 DLA-4243-1 MGASA-2024-0068 SUSE-SU-2024:0777-1 USN-6117-1

Timeline

22-09-2022
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

CVSS metrics

4 scores · 4 sources · 1 version

v3.15.3

EPSS trend

Probability

2.58%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

+0.45 pp

From 2.14% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Debian2 products

batik< 1.15+dfsg-1
debian_linuxEOL10.0

Org.apache.xmlgraphics2 products

batik≥ 1.14, < 1.15
batik-bridge≥ 1.14, < 1.15

Apache1 product

batik1.14

Apache software foundation1 product

apache xml graphicsBatik 1.14

Ubuntu1 product

batik< 1.7.ubuntu-8ubuntu2.14.04.3+esm1 | < 1.8-3ubuntu1+esm1 | < 1.10-2~18.04.1 | < 1.12-1ubuntu0.1 | < 1.14-1ubuntu0.2 | All versions (No fix recorded)

5 vendors · 7 products