CVE-2022-40146: apache software foundation apache xml graphics Server-Side Request Forgery (SSRF)

CVSS: 7.5v3.1HighModified

AliasesUBUNTU-CVE-2022-40146DEBIAN-CVE-2022-40146GHSA-h4qg-p7r2-cpg3

Published 22-09-2022Last modified 03-11-2025

Vulnerability summary

CVE-2022-40146 is a high (CVSS 7.5) Server-Side Request Forgery (SSRF) vulnerability in apache software foundation apache xml graphics. EPSS estimates a 7.43% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

7.43%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 2

DLA-3619-1 DLA-4243-1 MGASA-2024-0068 SUSE-SU-2024:0777-1 USN-6117-1

Timeline

22-09-2022
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

7.43%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 7.43% on 19-09-2026

19-09-202619-10-2026

EPSS score

7.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Debian2 products

batik< 1.15+dfsg-1
debian_linuxEOL10.0

Apache1 product

batik1.14

Apache software foundation1 product

apache xml graphicsBatik 1.14

Org.apache.xmlgraphics1 product

batik≥ 1.0, < 1.15

Ubuntu1 product

batik< 1.7.ubuntu-8ubuntu2.14.04.3+esm1 | < 1.8-3ubuntu1+esm1 | < 1.10-2~18.04.1 | < 1.12-1ubuntu0.1 | < 1.14-1ubuntu0.2 | All versions (No fix recorded)

5 vendors · 6 products