CVE-2022-40146: vulnerability in Apache XML Graphics
Jar url should be blocked by DefaultScriptSecurity
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 7.4%
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.
Affected products
Apache Software Foundation · Apache XML GraphicsRelated CVEs — Apache XML Graphics
In the same product, most dangerous first.
CVE-2022-42890—Apache Batik prior to 1.16 allows RCE via scriptingEPSS 3.4%CVE-2022-41704HIGHApache Batik prior to 1.16 allows RCE when loading untrusted SVG inputEPSS 3.1%CVE-2022-38398—Server-Side Request Forgery Information Disclosure VulnerabilityEPSS 2.6%CVE-2022-38648—PDFTranscoder does not block external resourcesEPSS 2.4%