CVE-2020-11987 Apache Batik
| Affected software | Apache Batik |
|---|---|
| Severity | 8.2 High CVSS 3.1 2 scores |
| Fixed in | 1.14 |
| Weakness | Server-side request forgery (CWE-918) |
| Published | 24 Feb 2021 |
| Updated | 8 Oct 2026 |
Description
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CWE-20 · Improper input validation
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 5 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 14% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
VRT has not found a public code change for this CVE yet.
- Protection none
- Action not pursued
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to No source fix or exploit. |
CVSS
8.2 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
2 metrics
CVSS
8.2 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
NVD | Primary | published |
| CVSS 2.0 | 6.4 | none | AV:N/AC:L/Au:N/C:P/I:P/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Communications / Security (Apache Batik) (46.6.4, 46.6.5) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Insurance Applications / Logger (Apache Batik) (1.0.1.8) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Fusion Middleware / Third Party Patch (Apache Batik) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications Data Model / Utilities (Apache Batik) (12.2.0.1) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Fusion Middleware / Centralized Third Party Jars (Apache Batik) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Supply Chain / Installation Issues (Apache Batik) (3.6.1) Oracle Supply Chain / Installation Issues (Apache Batik) (6.2.1.0) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Financial Services Applications / Framework (Apache Batik) (18.3, 19.1, 19.2, 20.1, 21.1) Oracle Financial Services Applications / Framework (Apache Batik) (18.3, 19.1, 19.2, 20.1, 21.1) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Insurance Applications / Architecture (Apache Batik) (11.0.0 - 11.3.1) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Communications Applications / UDC CORE (Apache Batik) (12.0.0.3.0) Oracle Financial Services Applications / General Ledger (Apache Batik) (14.1.0-14.4.0) Oracle Fusion Middleware / Install (Apache Batik) (12.2.1.4.0) Oracle Fusion Middleware / Security Subsystem - 12c (Apache Batik) (11.1.1.7.0) Oracle Retail Applications / Internal Operations (Apache Batik) (19.5) Oracle Retail Applications / Store Connect (Apache Batik) (15.0, 16.0) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Communications / Security (Apache Batik) (3.9m0p3) Oracle Communications Applications / Planning and Modeling (Apache Batik) (6.3.0, 6.3.1) Oracle Construction and Engineering / Dashboards and Reports (Apache Batik) (17.1, 17.2, 17.3) Oracle Retail Applications / Main Dashboard (Apache Batik) (14.1) Oracle Retail Applications / Mobile POS (Apache Batik) (14.1) Oracle Retail Applications / Pricing (Apache Batik) (14.1) Oracle Retail Applications / Pricing (Apache Batik) (14.1) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Security (Apache Batik) | 3.9m0p3 | 3.9.0.3 · 46.6.4 · 46.6.5 |
| Oracle Communications Applications | Planning and Modeling (Apache Batik) | 6.3.0, 6.3.1 | 6.3.0 · 6.3.1 |
| Oracle Communications Applications | UDC CORE (Apache Batik) | 12.0.0.3.0 | 12.0.0.3.0 |
| Oracle Communications Data Model | Utilities (Apache Batik) | 12.2.0.1 | 12.2.0.1 |
| Oracle Construction and Engineering | Dashboards and Reports (Apache Batik) | 17.1, 17.2, 17.3 | 17.1 · 17.2 · 17.3 |
| Oracle Financial Services Applications | Framework (Apache Batik) | 18.3, 19.1, 19.2, 20.1, 21.1 | 18.3 · 19.1 · 19.2 · 20.1 · 21.1 |
| Oracle Financial Services Applications | General Ledger (Apache Batik) | 14.1.0-14.4.0 | |
| Oracle Fusion Middleware | Centralized Third Party Jars (Apache Batik) | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Install (Apache Batik) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Subsystem - 12c (Apache Batik) | 11.1.1.7.0 | 11.1.1.7.0 |
| Oracle Fusion Middleware | Third Party Patch (Apache Batik) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Insurance Applications | Architecture (Apache Batik) | 11.0.0 - 11.3.1 | |
| Oracle Insurance Applications | Logger (Apache Batik) | 1.0.1.8 | 1.0.1.8 |
| Oracle Retail Applications | Internal Operations (Apache Batik) | 19.5 | 19.5 |
| Oracle Retail Applications | Main Dashboard (Apache Batik) | 14.1 | 14.1 |
| Oracle Retail Applications | Mobile POS (Apache Batik) | 14.1 | 14.1 |
| Oracle Retail Applications | Pricing (Apache Batik) | 14.1 | 14.1 |
| Oracle Retail Applications | Store Connect (Apache Batik) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Supply Chain | Installation Issues (Apache Batik) | 3.6.1 | 3.6.1 · 6.2.1.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.xmlgraphics:batik-svgbrowser |
0 | 1.14 |
unbounded |
Products and versions
23 products, 38 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | batik | generic | ≤ 1.13 |
| nvd | debian | debian linux | generic | 10.0 |
| nvd | fedoraproject | fedora | generic | 33 · 34 |
| nvd | oracle | agile engineering data management | generic | 6.2.1.0 |
| nvd | oracle | banking apis | generic | 18.3 · 19.1 · 19.2 · 20.1 · 21.1 |
| nvd | oracle | banking digital experience | generic | 18.3 · 19.1 · 19.2 · 20.1 · 21.1 |
| nvd | oracle | communications application session controller | generic | 3.9m0p3 |
| nvd | oracle | communications metasolv solution | generic | 6.3.0 · 6.3.1 |
| nvd | oracle | communications offline mediation controller | generic | 12.0.0.3.0 |
| nvd | oracle | enterprise repository | generic | 11.1.1.7.0 |
| nvd | oracle | flexcube universal banking | generic | ≥ 14.1.0 and ≤ 14.4.0 |
| nvd | oracle | fusion middleware mapviewer | generic | 12.2.1.4.0 |
| nvd | oracle | instantis enterprisetrack | generic | 17.1 · 17.2 · 17.3 |
| nvd | oracle | insurance policy administration | generic | ≥ 11.0 and ≤ 11.3.1 |
| nvd | oracle | product lifecycle analytics | generic | 3.6.1 |
| nvd | oracle | retail back office | generic | 14.1 |
| nvd | oracle | retail central office | generic | 14.1 |
| nvd | oracle | retail order broker | generic | 15.0 · 16.0 |
| nvd | oracle | retail order management system cloud service | generic | 19.5 |
| nvd | oracle | retail point-of-service | generic | 14.1 |
| nvd | oracle | retail returns management | generic | 14.1 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| osv | org.apache.xmlgraphics | batik-svgbrowser | generic | ＜ 1.14 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, ARCHITECTURE (APACHE BATIK), PRICING (APACHE BATIK), GENERAL LEDGER (APACHE BATIK), DASHBOARDS AND REPORTS (APACHE BATIK), SECURITY (APACHE BATIK), NO AUTH REMOTE EXPLOIT, MOBILE POS (APACHE BATIK), PLANNING AND MODELING (APACHE BATIK), INSTALL (APACHE BATIK), MAIN DASHBOARD (APACHE BATIK), SECURITY SUBSYSTEM - 12C (APACHE BATIK), TCP/IP, INTERNAL OPERATIONS (APACHE BATIK), FRAMEWORK (APACHE BATIK), UDC CORE (APACHE BATIK), STORE CONNECT (APACHE BATIK) **Products:** BATIK, ORACLE BANKING APIS, ORACLE FLEXCUBE UNIVERSAL BANKING, ORACLE RETAIL POINT-OF-SERVICE, ORACLE RETAIL RETURNS MANAGEMENT, ORACLE FUSION MIDDLEWARE, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE ENTERPRISE REPOSITORY, ORACLE INSURANCE POLICY ADMINISTRATION, ORACLE COMMUNICATIONS, ORACLE RETAIL CENTRAL OFFICE, ORACLE COMMUNICATIONS METASOLV SOLUTION, ORACLE RETAIL BACK OFFICE, INSTANTIS ENTERPRISETRACK, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL ORDER BROKER, ORACLE RETAIL ORDER MANAGEMENT SYSTEM CLOUD SERVICE, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE FUSION MIDDLEWARE MAPVIEWER, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE COMMUNICATIONS APPLICATION SESSION CONTROLLER, ORACLE INSURANCE APPLICATIONS, ORACLE BANKING DIGITAL EXPERIENCE, ORACLE COMMUNICATIONS OFFLINE MEDIATION CONTROLLER
References
Timeline
Timeline
| Published | 2021-02-24 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |