Read the docs
TI-2022-19036 Aliases CVE-2022-40146GHSA-h4qg-p7r2-cpg3

Jar url should be blocked by DefaultScriptSecurity

Priority MEDIUM 43CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Why it matters now

EPSS 0.07431 94th percentileScored 2026-11-07
Fix Partial org.apache.xmlgraphics:batik (Maven): 1.15Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache XML GraphicsBatik 1.14—No fix listedCNA
—org.apache.xmlgraphics:batik (Maven)1.0 to before 1.151.15Patch availableGHSA-h4qg-p7r2-cpg3
  • Apache XML Graphics VendorApache Affected Batik 1.14 Fixed in — No fix listed CNA
  • org.apache.xmlgraphics:batik (Maven) Vendor— Affected 1.0 to before 1.15 Fixed in 1.15 Patch available GHSA-h4qg-p7r2-cpg3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:batik:1.14:*:*:*:*:*:*:*1.14VulnerableApache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:apache:batik:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-h4qg-p7r2-cpg3 org.apache.xmlgraphics:batik (Maven) Fixed in 1.15 Advisory →

Red Hat 2 advisories

  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
Red Hat Fuse 7.12Fixed RHSA-2023:3954

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40146
  2. 2026-10-03 Alias added: GHSA-h4qg-p7r2-cpg3

References

Advisory 3

Other 4

  • TI-2018-05790 Deserialization of untrusted data in Apache Batik CVSS 3.0CRITICAL 9.8
  • TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
  • TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
  • TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
  • TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input CVSS 3.1HIGH 7.5
  • TI-2022-20886 Apache Batik prior to 1.16 allows RCE via scripting CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences