CVE-2022-44729

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-44729
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing List Third Party Advisory
https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
https://security.gentoo.org/glsa/202401-11
https://xmlgraphics.apache.org/security.html Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing List Third Party Advisory
https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
https://security.gentoo.org/glsa/202401-11
https://xmlgraphics.apache.org/security.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:xml_graphics_batik:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

13 Feb 2025, 17:15

Type Values Removed Values Added
Summary (en) Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later. (en) Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

21 Nov 2024, 07:28

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/08/22/2 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/08/22/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/08/22/4 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/08/22/4 - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 - Mailing List, Vendor Advisory () https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 - Mailing List, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html - Mailing List () https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html - Mailing List
References () https://security.gentoo.org/glsa/202401-11 - () https://security.gentoo.org/glsa/202401-11 -
References () https://xmlgraphics.apache.org/security.html - Vendor Advisory () https://xmlgraphics.apache.org/security.html - Vendor Advisory

07 Jan 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-11 -
Information

Published : 2023-08-22 19:16

Updated : 2025-02-13 17:15

NVD link : CVE-2022-44729

Mitre link : CVE-2022-44729

CVE.ORG link : CVE-2022-44729

JSON object : View

Products Affected

debian

  • debian_linux

apache

  • xml_graphics_batik
CWE
CWE-918

Server-Side Request Forgery (SSRF)