Vulnerabilities > CVE-2020-11987 - Server-Side Request Forgery (SSRF) vulnerability in multiple products

CVSS 8.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

LOW

Availability impact

NONE

network

low complexity

NVD

Published: 2021-02-24

Updated: 2024-11-21

Summary

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Batik - Apache Batik 1.0 Apache Batik 1.1 Apache Batik 1.1.1 Apache Batik 1.5 Apache Batik 1.5.1 Apache Batik 1.6 Apache Batik 1.6.1 Apache Batik 1.7 Apache Batik 1.7.1 Apache Batik 1.8 Apache Batik 1.9 Apache Batik 1.9.1 Apache Batik 1.10 Apache Batik 1.12	27
Application	Oracle Oracle Enterprise Repository 11.1.1.7.0 Oracle Retail Back Office 14.1 Oracle Weblogic Server 12.2.1.3.0 Oracle Weblogic Server 12.2.1.4.0 Oracle Weblogic Server 14.1.1.0.0 Oracle Retail Order Broker 15.0 Oracle Retail Order Broker 16.0 Oracle Retail Returns Management 14.1 Oracle Retail Central Office 14.1 Oracle Retail Point OF Service 14.1 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3 Oracle Communications Metasolv Solution 6.3.0 Oracle Communications Metasolv Solution 6.3.1 Oracle Banking Digital Experience 18.3 Oracle Banking Digital Experience 19.1 Oracle Banking Digital Experience 19.2 Oracle Banking Digital Experience 20.1 Oracle Banking Digital Experience 21.1 Oracle Fusion Middleware Mapviewer 12.2.1.4.0 Oracle Communications Offline Mediation Controller 12.0.0.3.0 Oracle Agile Engineering Data Management 6.2.1.0 Oracle Communications Application Session Controller 3.9M0P3 Oracle Insurance Policy Administration 11.0 Oracle Insurance Policy Administration 11.0.2 Oracle Insurance Policy Administration 11.1.0 Oracle Insurance Policy Administration 11.2.0 Oracle Insurance Policy Administration 11.2.7 Oracle Insurance Policy Administration 11.2.8 Oracle Insurance Policy Administration 11.3.0 Oracle Insurance Policy Administration 11.3.1 Oracle Retail Order Management System Cloud Service 19.5 Oracle Flexcube Universal Banking 14.1.0 Oracle Flexcube Universal Banking 14.2.0 Oracle Flexcube Universal Banking 14.3.0 Oracle Flexcube Universal Banking 14.4.0 Oracle Banking Apis 19.1 Oracle Banking Apis 19.2 Oracle Banking Apis 20.1 Oracle Banking Apis 21.1 Oracle Banking Apis 18.3 Oracle Product Lifecycle Analytics 3.6.1	43
OS	Fedoraproject Fedoraproject Fedora 33 Fedoraproject Fedora 34	2
OS	Debian Debian Debian Linux 10.0	1

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References