CVE-2022-38398: vulnerability in Apache XML Graphics
Server-Side Request Forgery Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.6%
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.
Affected products
Apache Software Foundation · Apache XML GraphicsRelated CVEs — Apache XML Graphics
In the same product, most dangerous first.
CVE-2022-40146—Jar url should be blocked by DefaultScriptSecurityEPSS 7.4%CVE-2022-42890—Apache Batik prior to 1.16 allows RCE via scriptingEPSS 3.4%CVE-2022-41704HIGHApache Batik prior to 1.16 allows RCE when loading untrusted SVG inputEPSS 3.1%CVE-2022-38648—PDFTranscoder does not block external resourcesEPSS 2.4%