CVE-2022-38398 (Medium) detected in batik-all-1.13.jar, batik-bridge-1.13.jar

[mend-bolt-for-github]

CVE-2022-38398 - Medium Severity Vulnerability

Vulnerable Libraries - batik-all-1.13.jar, batik-bridge-1.13.jar

batik-all-1.13.jar

Batik aggregate artifact

Path to dependency file: /dependency-reduced-pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/xmlgraphics/batik-all/1.13/batik-all-1.13.jar

Dependency Hierarchy:

• poi-ooxml-5.0.0.jar (Root Library)
  • ❌ batik-all-1.13.jar (Vulnerable Library)

batik-bridge-1.13.jar

Batik bridge

Library home page: http://xmlgraphics.apache.org/batik/

Path to dependency file: /dependency-reduced-pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/xmlgraphics/batik-bridge/1.13/batik-bridge-1.13.jar

Dependency Hierarchy:

• poi-ooxml-5.0.0.jar (Root Library)
  • batik-all-1.13.jar
    • ❌ batik-bridge-1.13.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

Publish Date: 2022-09-22

URL: CVE-2022-38398

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/712c9xwtmyghyokzrm2ml6sps4xlmbsx

Release Date: 2022-09-22

Fix Resolution (org.apache.xmlgraphics:batik-all): 1.15

Direct dependency fix Resolution (org.apache.poi:poi-ooxml): 5.1.0

Fix Resolution (org.apache.xmlgraphics:batik-bridge): 1.15

Direct dependency fix Resolution (org.apache.poi:poi-ooxml): 5.1.0

---

Step up your Open Source Security Game with Mend here