Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2020-11987 - High Severity Vulnerability
Batik SVG Browser Application Library
Library home page: http://xmlgraphics.apache.org/batik/
Path to dependency file: www.renfei.net/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/xmlgraphics/batik-svgbrowser/1.13/batik-svgbrowser-1.13.jar
Dependency Hierarchy: - sdk-1.1.1.jar (Root Library) - poi-ooxml-5.0.0.jar - batik-all-1.13.jar - :x: **batik-svgbrowser-1.13.jar** (Vulnerable Library)
Found in HEAD commit: 43a472f276e5168dd868592643b603f9e9b55071
Found in base branch: master
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Publish Date: 2021-02-24
URL: CVE-2020-11987
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11987
Release Date: 2021-02-24
Fix Resolution: org.apache.xmlgraphics:batik-svgbrowser:1.14
Step up your Open Source Security Game with WhiteSource here