CVE-2019-17566
- Source
- https://cve.org/CVERecord?id=CVE-2019-17566
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17566.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-17566
- Aliases
- Downstream
- Related
- Published
- 2020-11-12T18:15:12.567Z
- Modified
- 2026-03-15T22:31:02.555580Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
- References
-
- https://lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509%40%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171%40%3Ccommits.myfaces.apache.org%3E
- https://security.gentoo.org/glsa/202401-11
- https://xmlgraphics.apache.org/security.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Affected packages
Git / github.com/apache/batik
Database specific
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.1.2.4.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.5.0.0.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.9.0.0.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.2.1.3.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.2.1.4.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.9m0p2"
}
]
},
{
"events": [
{
"introduced": "6.3.0"
},
{
"last_affected": "6.3.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.0.0.3.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.1.1.7.0"
}
]
},
{
"events": [
{
"introduced": "8.0.6"
},
{
"last_affected": "8.1.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.2.1.4.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.6"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.1.2.4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.2.5.0"
}
]
},
{
"events": [
{
"introduced": "17.1"
},
{
"last_affected": "17.3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.4.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.2.4.2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "15.0.3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "15.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "19.5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.1"
}
]
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17566.json"