PT-2022-25243 · Apache+6 · Apache Xml Graphics Batik+7

Chudypb + 1 · Published 2022-09-22 · Updated 2025-07-20 · CVE-2022-40146

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache XML Graphics Batik version 1.14 Confluence Data Center and Server versions 7.13.0 through 7.19.0

Description A Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue can be exploited by an unauthenticated attacker to expose assets in the environment susceptible to exploitation, which has a high impact on confidentiality.

Recommendations For Apache XML Graphics Batik version 1.14, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Confluence Data Center and Server versions 7.13.0 through 7.19.0, upgrade to a release greater than or equal to 7.19.16.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-40146

DLA-3619-1

DLA-4243-1

GHSA-H4QG-P7R2-CPG3

MGASA-2024-0068

OESA-2023-1651

OPENSUSE-SU-2024:12363-1

SUSE-SU-2024:0777-1

SUSE-SU-2024_0777-1

USN-6117-1

ZDI-22-1327

Affected Products

Apache Xml Graphics Batik

Astra Linux

Confluence

Debian

Jira

Linuxmint

Suse

Ubuntu

References · 70

• 🔥 https://github.com/cckuailong/CVE-2022-40146_Exploit_Jar · Exploit
• https://osv.dev/vulnerability/CVE-2022-40146 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1327 · Security Note
• https://advisories.mageia.org/MGASA-2024-0068.html · Security Note
• https://ubuntu.com/security/CVE-2022-41704 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3619-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40146 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38648 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/684813 · Security Note
• https://osv.dev/vulnerability/GHSA-h4qg-p7r2-cpg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44729 · Security Note
• https://ubuntu.com/security/CVE-2020-11987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44730 · Security Note
• https://osv.dev/vulnerability/DLA-4243-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0068 · Vendor Advisory