Oracle Fusion Middleware / Install (Apache Batik) CVEs · Protected by Waratek

Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 1 50.0% High 1 50.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q2 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1

Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19Q4 19Q1 20Q2 20Q3 20Q4 20

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2019-17566	High	2020-11-12	Protected by Waratek	No public exploit	Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2018-8013	Critical	2018-05-24	Protected by Waratek	No public exploit	In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2019-17566

High

2020-11-12

Protected by Waratek

No public exploit

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

CVE-2018-8013

Critical

2018-05-24

Protected by Waratek

No public exploit

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.