Vulnerabilities > CVE-2022-42890 - Server-Side Request Forgery (SSRF) vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | Apache
| 29 |
| OS | 2 |
Common Weakness Enumeration (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/10/25/3
- http://www.openwall.com/lists/oss-security/2022/10/25/3
- https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly
- https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly
- https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html
- https://security.gentoo.org/glsa/202401-11
- https://security.gentoo.org/glsa/202401-11
- https://www.debian.org/security/2022/dsa-5264
- https://www.debian.org/security/2022/dsa-5264