Read the docs
TI-2019-13109 Aliases CVE-2019-17566GHSA-cmx4-p4v5-hmr5

Server-side request forgery in Apache Batik

Priority MEDIUM 46CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 3 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Why it matters now

EPSS 0.10867 95th percentileScored 2026-11-07
Fix Partial org.apache.xmlgraphics:batik (Maven): 1.13Red Hat: 3 advisoriesRed Hat: 3 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache BatikApache Batik 1.12 and older—No fix listedCNA
—org.apache.xmlgraphics:batik (Maven)before 1.131.13Patch availableGHSA-cmx4-p4v5-hmr5
  • Apache Batik Vendor— Affected Apache Batik 1.12 and older Fixed in — No fix listed CNA
  • org.apache.xmlgraphics:batik (Maven) Vendor— Affected before 1.13 Fixed in 1.13 Patch available GHSA-cmx4-p4v5-hmr5

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:*before 1.13VulnerableApache
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*11.1.2.4.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*5.5.0.0.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*5.9.0.0.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p2:*:*:*:*:*:*:*3.9m0p2VulnerableOracle
cpe:2.3:a:oracle:communications_metasolv_solution:*:*:*:*:*:*:*:*6.3.0 – 6.3.1VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*11.1.1.7.0VulnerableOracle
  • cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:* Versions before 1.13 Vulnerable ·Apache
  • cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* Versions 11.1.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* Versions 5.5.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* Versions 5.9.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p2:*:*:*:*:*:*:* Versions 3.9m0p2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_metasolv_solution:*:*:*:*:*:*:*:* Versions 6.3.0 – 6.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.6 – 8.1.0VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_opera_5:5.5:*:*:*:*:*:*:*5.5VulnerableOracle
cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*5.6VulnerableOracle
cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*11.1.2.4VulnerableOracle
cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.5.0:*:*:*:*:*:*:*11.2.5.0VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*17.1 – 17.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.4.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.4.2:*:*:*:*:*:*:*9.2.4.2VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_management_system_cloud_service:19.5:*:*:*:*:*:*:*19.5VulnerableOracle
cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_opera_5:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:* Versions 11.1.2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.5.0:*:*:*:*:*:*:* Versions 11.2.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.4.2:*:*:*:*:*:*:* Versions 9.2.4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_management_system_cloud_service:19.5:*:*:*:*:*:*:* Versions 19.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-cmx4-p4v5-hmr5 org.apache.xmlgraphics:batik (Maven) Fixed in 1.13 Advisory →

Red Hat 3 advisories

  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0
  • RHSA-2020:4961 Released 2020-11-05 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.9.0 security update
    • RHPAM 7.9.0
  • RHSA-2020:4960 Released 2020-11-05 · Red Hat rating Moderate
    Red Hat Decision Manager 7.9.0 security update
    • RHDM 7.9.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
RHDM 7.9.0Fixed RHSA-2020:4960
RHPAM 7.9.0Fixed RHSA-2020:4961
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17566
  2. 2026-10-03 Alias added: GHSA-cmx4-p4v5-hmr5

References

Patch 6

Advisory 3

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences