TI-2022-18023 Aliases CVE-2022-38398 GHSA-c5xv-qc8p-mh2v

Server-side request forgery information disclosure in Apache XML Graphics

LOW 29CWE-918Published 2022-09-22 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 2 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

Why it matters now

EPSS 0.02584 85th percentileScored 2026-11-07

Fix Partial org.apache.xmlgraphics:batik (Maven): 1.15org.apache.xmlgraphics:batik-bridge (Maven): 1.15Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache XML Graphics	Batik 1.14	—	No fix listed	CNA
—	org.apache.xmlgraphics:batik (Maven)	1.14 to before 1.15	1.15	Patch available	GHSA-c5xv-qc8p-mh2v
—	org.apache.xmlgraphics:batik-bridge (Maven)	1.14 to before 1.15	1.15	Patch available	GHSA-c5xv-qc8p-mh2v

Apache XML Graphics VendorApache Affected Batik 1.14 Fixed in — No fix listed CNA
org.apache.xmlgraphics:batik (Maven) Vendor— Affected 1.14 to before 1.15 Fixed in 1.15 Patch available GHSA-c5xv-qc8p-mh2v
org.apache.xmlgraphics:batik-bridge (Maven) Vendor— Affected 1.14 to before 1.15 Fixed in 1.15 Patch available GHSA-c5xv-qc8p-mh2v

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:batik:1.14:::::::*	1.14	Vulnerable	Apache
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:apache:batik:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Apache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · GHSA-c5xv-qc8p-mh2v org.apache.xmlgraphics:batik (Maven) Fixed in 1.15 Advisory →
Fix · GHSA-c5xv-qc8p-mh2v org.apache.xmlgraphics:batik-bridge (Maven) Fixed in 1.15 Advisory →

Red Hat 2 advisories

RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
Red Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
Red Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Decision Manager 7	Affected	No fix planned: Out of support scope
Red Hat Integration Camel K 1	Affected	No fix yet
Red Hat Integration Camel Quarkus 1	Affected	No fix planned: Will not fix
Red Hat JBoss Data Grid 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Fuse 6	Affected	No fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6	Affected	No fix planned: Out of support scope
Red Hat Process Automation 7	Affected	No fix planned: Out of support scope
Red Hat build of Quarkus	Affected	No fix planned: Will not fix
RHINT Camel-Springboot 3.20.1	Fixed	RHSA-2023:2100
Red Hat Fuse 7.12	Fixed	RHSA-2023:3954

Timeline

2026-10-02 Threatist record created from CVE-2022-38398
2026-10-03 Alias added: GHSA-c5xv-qc8p-mh2v

References

Advisory 3

Other 4

TI-2018-05790 Deserialization of untrusted data in Apache Batik CVSS 3.0CRITICAL 9.8
TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input CVSS 3.1HIGH 7.5
TI-2022-19036 Jar url should be blocked by DefaultScriptSecurity CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences