Read the docs
TI-2022-22019 Aliases CVE-2022-44730GHSA-2474-2566-3qxp

Apache XML Graphics Batik: Information disclosure vulnerability

Priority LOW 22CWE-918Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

Why it matters now

EPSS 0.00816 57th percentileScored 2026-11-07
Fix Partial org.apache.xmlgraphics:batik-script (Maven): 1.17Red Hat: 2 advisoriesRed Hat: 2 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache XML Graphics Batik1.16—No fix listedCNA
—org.apache.xmlgraphics:batik-script (Maven)1.0 to before 1.171.17Patch availableGHSA-2474-2566-3qxp
  • Apache XML Graphics Batik VendorApache Affected 1.16 Fixed in — No fix listed CNA
  • org.apache.xmlgraphics:batik-script (Maven) Vendor— Affected 1.0 to before 1.17 Fixed in 1.17 Patch available GHSA-2474-2566-3qxp

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:xml_graphics_batik:*:*:*:*:*:*:*:*1.0 – 1.16VulnerableApache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:apache:xml_graphics_batik:*:*:*:*:*:*:*:* Versions 1.0 – 1.16 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-2474-2566-3qxp org.apache.xmlgraphics:batik-script (Maven) Fixed in 1.17 Advisory →

Red Hat 2 advisories

  • RHSA-2024:1353 Released 2024-03-18 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.5 security update
    • RHPAM 7.13.5 async
  • RHSA-2023:5441 Released 2023-10-04 · Red Hat rating Moderate
    Red Hat Integration Camel for Spring Boot 4.0.0 release and security update
    • RHINT Camel-Springboot 4.0.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix yet
RHINT Camel-Springboot 4.0.0Fixed RHSA-2023:5441
RHPAM 7.13.5 asyncFixed RHSA-2024:1353
Not affected: 6 products
  • Red Hat Data Grid 8
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of OptaPlanner 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-44730
  2. 2026-10-03 Alias added: GHSA-2474-2566-3qxp

References

Advisory 5

Other 6

  • TI-2022-22018 Apache XML Graphics Batik: Information disclosure vulnerability CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences