PT-2022-24497 · Apache+5 · Apache Xml Graphics Batik+5

Adam Rauch · Published 2022-09-22 · Updated 2025-07-20 · CVE-2022-38648

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache XML Graphics Batik version 1.14

Description A Server-Side Request Forgery (SSRF) issue allows an attacker to fetch external resources. This can be exploited by an attacker to access resources that should not be accessible.

Recommendations For Apache XML Graphics Batik version 1.14, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-38648

DLA-3619-1

DLA-4243-1

GHSA-53JM-3HC9-FQQC

MGASA-2024-0068

OESA-2023-1651

OPENSUSE-SU-2024:12363-1

SUSE-SU-2024:0777-1

USN-6117-1

Affected Products

Apache Xml Graphics Batik

Astra Linux

Debian

Linuxmint

Suse

Ubuntu

References · 64

• 🔥 https://github.com/cckuailong/CVE-2022-40146_Exploit_Jar · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38648 · Security Note
• https://advisories.mageia.org/MGASA-2024-0068.html · Security Note
• https://osv.dev/vulnerability/DLA-3619-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41704 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-38648 · Security Note
• https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44729 · Security Note
• https://ubuntu.com/security/CVE-2020-11987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40146 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-44730 · Security Note
• https://osv.dev/vulnerability/DLA-4243-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-38648 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38648 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0068 · Vendor Advisory