High · published February 24, 2021
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
| Product | Versions | Fixed in |
|---|---|---|
| apache/batik | ≤ 1.13 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/banking_apis | all versions | — |
| oracle/banking_apis | all versions | — |
| oracle/banking_apis | all versions | — |
| oracle/banking_apis | all versions | — |
| oracle/banking_apis | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/communications_application_session_controller | all versions | — |
| oracle/communications_metasolv_solution | all versions | — |
| oracle/communications_metasolv_solution | all versions | — |
| oracle/communications_offline_mediation_controller | all versions | — |
| oracle/enterprise_repository | all versions | — |
| oracle/flexcube_universal_banking | ≥ 14.1.0, ≤ 14.4.0 | — |
| oracle/fusion_middleware_mapviewer | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/insurance_policy_administration | ≥ 11.0, ≤ 11.3.1 | — |
| oracle/product_lifecycle_analytics | all versions | — |
| oracle/retail_back_office | all versions | — |
| oracle/retail_central_office | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_management_system_cloud_service | all versions | — |
| oracle/retail_point-of-service | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| debian/debian_linux | all versions | — |