İçeriğe geç
Bilgi ve Teknoloji Uygulamada aç

Yüksek CVSS 8.2

CVE-2020-11987: Batik: hatalı girdi doğrulama

Yayın: · Güncelleme:

Açıklama (NVD)

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Özet bilgiler

Ürün
Apache Batik
CVSS v3.1
8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS
%13,64 (yüzdelik 96)
CWE
CWE-20
Yama
Mevcut

Etkilenen sürümler

ÜrünBaşlangıçBitişDüzeltildi
apache-batik—1.13—
fedoraproject-fedora3333—
fedoraproject-fedora3434—
oracle-agile-engineering-data-management6.2.1.06.2.1.0—
oracle-banking-apis18.318.3—
oracle-banking-apis19.119.1—
oracle-banking-apis19.219.2—
oracle-banking-apis20.120.1—
oracle-banking-apis21.121.1—
oracle-banking-digital-experience18.318.3—
oracle-banking-digital-experience19.119.1—
oracle-banking-digital-experience19.219.2—
oracle-banking-digital-experience20.120.1—
oracle-banking-digital-experience21.121.1—
oracle-communications-application-session-controller3.9m0p33.9m0p3—
oracle-communications-metasolv-solution6.3.06.3.0—
oracle-communications-metasolv-solution6.3.16.3.1—
oracle-communications-offline-mediation-controller12.0.0.3.012.0.0.3.0—
oracle-enterprise-repository11.1.1.7.011.1.1.7.0—
oracle-flexcube-universal-banking14.1.014.4.0—
oracle-fusion-middleware-mapviewer12.2.1.4.012.2.1.4.0—
oracle-instantis-enterprisetrack17.117.1—
oracle-instantis-enterprisetrack17.217.2—
oracle-instantis-enterprisetrack17.317.3—
oracle-insurance-policy-administration11.011.3.1—
oracle-product-lifecycle-analytics3.6.13.6.1—
oracle-retail-back-office14.114.1—
oracle-retail-central-office14.114.1—
oracle-retail-order-broker15.015.0—
oracle-retail-order-broker16.016.0—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları