Apache XML Graphics Batik: Information disclosure vulnerability
Published Aug 22, 2023
7.1
HIGHCVSS 3.1
EPSS 0.92%
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Affected products
-
- Version 1.16StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache XML Graphics Batik | unaffected |
|
Configuration 1
- ≥ 1.0 · ≤ 1.16
Configuration 2
- 10.0
No data.
RHINT Camel-Springboot 4.0.0
batik
Fixed · RHSA-2023:5441
RHPAM 7.13.5 async
batik
Fixed · RHSA-2024:1353
Red Hat Data Grid 8
batik
Not affected
Red Hat Decision Manager 7
batik
Affected
Red Hat Enterprise Linux 6
batik
Out of support scope
Red Hat Enterprise Linux 6
fop
Out of support scope
Red Hat Enterprise Linux 7
batik
Out of support scope
Red Hat Enterprise Linux 8
batik
Will not fix
Red Hat Fuse 7
batik
Out of support scope
Red Hat Integration Camel K 1
batik
Will not fix
Red Hat JBoss Data Grid 7
batik
Not affected
Red Hat JBoss Enterprise Application Platform 7
batik
Not affected
Red Hat JBoss Enterprise Application Platform 8
batik
Not affected
Red Hat JBoss Enterprise Application Platform Expansion Pack
batik
Not affected
Red Hat JBoss Fuse 6
batik
Out of support scope
Red Hat JBoss Fuse Service Works 6
batik
Out of support scope
Red Hat build of Apache Camel for Spring Boot 3
batik
Affected
Red Hat build of OptaPlanner 8
batik
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| RHINT Camel-Springboot 4.0.0 | batik | Fixed | RHSA-2023:5441 |
| RHPAM 7.13.5 async | batik | Fixed | RHSA-2024:1353 |
| Red Hat Data Grid 8 | batik | Not affected | n/a |
| Red Hat Decision Manager 7 | batik | Affected | n/a |
| Red Hat Enterprise Linux 6 | batik | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | fop | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | batik | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | batik | Will not fix | n/a |
| Red Hat Fuse 7 | batik | Out of support scope | n/a |
| Red Hat Integration Camel K 1 | batik | Will not fix | n/a |
| Red Hat JBoss Data Grid 7 | batik | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | batik | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 8 | batik | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | batik | Not affected | n/a |
| Red Hat JBoss Fuse 6 | batik | Out of support scope | n/a |
| Red Hat JBoss Fuse Service Works 6 | batik | Out of support scope | n/a |
| Red Hat build of Apache Camel for Spring Boot 3 | batik | Affected | n/a |
| Red Hat build of OptaPlanner 8 | batik | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
1 other source (Red Hat) ▾
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2023–2026- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (8 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.92% (0.00919) | 58.83th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.79% (0.00786) | 51.16th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.06% (0.00060) | 16.12th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.16% (0.00157) | 53.49th | v3 (v2023.03.01) |
| Jan 10, 2024 | 0.10% (0.00097) | 40.16th | v3 (v2023.03.01) |
| Oct 15, 2023 | 0.09% (0.00092) | 38.70th | v3 (v2023.03.01) |
| Aug 26, 2023 | 0.06% (0.00064) | 26.36th | v3 (v2023.03.01) |
| Aug 23, 2023 | 0.06% (0.00062) | 24.34th | v3 (v2023.03.01) |
References (14)
- http://www.openwall.com/lists/oss-security/2023/08/22/2 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/08/22/4 Mailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-44729 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2233889 Issue Tracking
- https://github.com/advisories/GHSA-gq5f-xv48-2365 Advisory
- https://github.com/apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d5ba47d0b69b
- https://github.com/apache/xmlgraphics-batik/commit/aaa1dd3e6b5a7df781d73e0c37a1df6a8f318893
- https://issues.apache.org/jira/browse/BATIK-1349
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 vendor-advisoryMailing ListVendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
- https://nvd.nist.gov/vuln/detail/CVE-2022-44729
- https://security.gentoo.org/glsa/202401-11
- https://www.cve.org/CVERecord?id=CVE-2022-44729
- https://xmlgraphics.apache.org/security.html Vendor Advisory
Change history (0)
No recorded changes yet.