PT-2022-5345 · Atlassian+6 · Confluence+8

4Ra1N + 1 · Published 2022-10-25 · Updated 2024-03-16 · CVE-2022-42890

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache XML Graphics versions prior to 1.16 Confluence Data Center and Server versions 7.13.0 and 7.19.0

Description A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue is related to insufficient checking of incoming requests. The exploitation of this issue may allow a remote attacker to execute arbitrary Java code.

Recommendations For Apache XML Graphics versions prior to 1.16, upgrade to version 1.16. For Confluence Data Center and Server version 7.19, upgrade to a release greater than or equal to 7.19.16.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2022-06659

CVE-2022-42890

DLA-3169-1

DSA-5264-1

GHSA-RWQR-M72Q-V6CM

MGASA-2024-0068

OESA-2023-1050

OESA-2023-1051

OESA-2023-1057

OESA-2023-1060

OPENSUSE-SU-2024:13743-1

OPENSUSE-SU-2024_0808-1

ROSA-SA-2023-2239

SUSE-SU-2024:0777-1

SUSE-SU-2024:0808-1

USN-6117-1

Affected Products

Apache Xml Graphics

Astra Linux

Batik

Confluence

Jira

Linuxmint

Red Os

Suse

Ubuntu

References · 80

• 🔥 https://github.com/cckuailong/CVE-2022-40146_Exploit_Jar · Exploit
• https://advisories.mageia.org/MGASA-2024-0068.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42890 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1057 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rwqr-m72q-v6cm · Vendor Advisory
• https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11987 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1051 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42890 · Vendor Advisory
• https://debian.org/security/2022/dsa-5264 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17566 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06659 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0808-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202401-11 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40146 · Vendor Advisory