CVE-2020-11987: Input Validation
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-11987.
What is the severity level of CVE-2020-11987?
The severity level of CVE-2020-11987 is high (8.2).
What is the affected software for CVE-2020-11987?
The affected software for CVE-2020-11987 includes Apache Batik versions 1.7.ubuntu-8ubuntu2.14.04.3+, 1.8-3ubuntu1+, 1.10-2~18.04.1, 1.12-1ubuntu0.1, 1.14, 1.16+dfsg-1, 1.17+dfsg-1, and org.apache.xmlgraphics:batik-svgbrowser version 1.14.
What is the vulnerability description for CVE-2020-11987?
CVE-2020-11987 is a server-side request forgery vulnerability in Apache Batik 1.13, caused by improper input validation by the NodePickerPanel. It allows an attacker to exploit the vulnerability and cause the underlying server to make arbitrary GET requests.
How can I fix CVE-2020-11987?
To fix CVE-2020-11987, it is recommended to update to the patched versions of Apache Batik (1.10-2~18.04.1, 1.12-1ubuntu0.1) or apply the necessary security updates provided by the respective software vendors.