Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2020-11987 - High Severity Vulnerability
Batik SVG Browser Application Library
Library home page: http://xmlgraphics.apache.org/batik/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/xmlgraphics/batik-svgbrowser/1.13/batik-svgbrowser-1.13.jar
Dependency Hierarchy: - poi-ooxml-5.0.0.jar (Root Library) - batik-all-1.13.jar - :x: **batik-svgbrowser-1.13.jar** (Vulnerable Library)
Found in HEAD commit: 49bc97d287f40c56cedf968f62c42374c32e123c
Found in base branch: master
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Publish Date: 2021-02-24
URL: CVE-2020-11987
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11987
Release Date: 2021-02-24
Fix Resolution (org.apache.xmlgraphics:batik-svgbrowser): 1.14
Direct dependency fix Resolution (org.apache.poi:poi-ooxml): 5.1.0
Step up your Open Source Security Game with Mend here