CVE-2022-38648

5.3 MEDIUM

Published: September 22, 2022 Modified: November 03, 2025

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b

Source: security@apache.org

Mailing List Vendor Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html

Source: security@apache.org

Mailing List

https://security.gentoo.org/glsa/202401-11

Source: security@apache.org

https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Vendor Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202401-11

Source: af854a3a-2127-422b-91ae-364da2661108

7 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.3 / 10.0

EPSS (Exploit Probability)

0.1%

36th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-918 CWE-918

Affected Vendors

apache debian

Related CVEs