GHSA-53jm-3hc9-fqqc

Apache Batik vulnerable to Server-Side Request Forgery

At a glance

Published: 2022-09-23 00:00 UTC
Updated: 2025-11-03 22:02 UTC
CVE: CVE-2022-38648
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.

Affected packages

Package	Versions
Maven · org.apache.xmlgraphics:batik	introduced 0, fixed 1.15
Maven · org.apache.xmlgraphics:batik-bridge	introduced 0, fixed 1.15

References

https://nvd.nist.gov/vuln/detail/CVE-2022-38648 ADVISORY
https://github.com/apache/xmlgraphics-batik/commit/996aa8897c208be11ce65cef00c9576a299b2637 WEB
https://github.com/apache/xmlgraphics-batik PACKAGE
https://issues.apache.org/jira/browse/BATIK-1333 WEB
https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b WEB
https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html WEB
https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html WEB
https://security.gentoo.org/glsa/202401-11 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database