CVE-2022-38648

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Score

CVSS 3.1 5.3 Medium

Status

Modified - security@apache.org

Published

2022-09-22

Last modified

2025-11-03

Weaknesses

CWE-918

Affected products

• Batik (Apache)
• Apache Xml Graphics (Apache Software Foundation)
• Debian Linux (Debian)

References

• https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b
• https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html
• https://security.gentoo.org/glsa/202401-11
• https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html