Vulnerability Name:

CVE-2019-17566 (CCN-183402)

Assigned:2019-10-14
Published:2020-06-15
Updated:2022-12-06
Summary:Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-17566

Source: XF
Type: UNKNOWN
apache-cve201917566-ssrf(183402)

Source: security@apache.org
Type: Mailing List, Patch, Vendor Advisory
security@apache.org

Source: security@apache.org
Type: Mailing List, Patch, Vendor Advisory
security@apache.org

Source: CCN
Type: oss-sec Mailing List, Mon, 15 Jun 2020 09:58:53 +0100
[CVE-2019-17566] Apache XML Graphics Batik SSRF vulnerability

Source: CCN
Type: IBM Security Bulletin 6322683 (WebSphere Application Server)
Vulnerability in Apache Batik affects WebSphere Application Server (CVE-2019-17566)

Source: CCN
Type: IBM Security Bulletin 6327411 (WebSphere Application Server in Cloud)
Multiple Security Vulnerabilities Affect IBM WebSphere Application Server in IBM Cloud

Source: CCN
Type: IBM Security Bulletin 6333051 (Curam Social Program Management)
Vulnerability in Apache Batik library affects IBM Curam Social Program Management (CVE-2019-17566)

Source: CCN
Type: IBM Security Bulletin 6339089 (Cloud Orchestrator)
Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Source: CCN
Type: IBM Security Bulletin 6344075 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6351443 (Tivoli Monitoring V6)
Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application and IHS server

Source: CCN
Type: IBM Security Bulletin 6382228 (Tivoli Netcool OMNIbus)
Multiple vulnerabilities in Apache Batik affect Tivoli Netcool/OMNIbus WebGUI (CVE-2017-5662, CVE-2018-8013, CVE-2015-0250, CVE-2019-17566)

Source: CCN
Type: IBM Security Bulletin 6422665 (StoredIQ for Legal)
Multiple Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM StoredIQ for Legal

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle Critical Patch Update Advisory - April 2021
Oracle Critical Patch Update Advisory - April 2021

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle CPUJan2021
Oracle Critical Patch Update Advisory - January 2021

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle CPUJan2022
Oracle Critical Patch Update Advisory - January 2022

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Oracle CPUJul2021
Oracle Critical Patch Update Advisory - July 2021

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: security@apache.org
Type: Patch, Third Party Advisory
security@apache.org

Source: CCN
Type: Apache Batik Web site
Apache Batik

Source: security@apache.org
Type: Vendor Advisory
security@apache.org

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:apache:batik:1.12:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_monitoring:6.3.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_order_broker_cloud_service:15.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:retail_order_broker_cloud_service:16.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:business_intelligence:12.2.1.3.0::~~enterprise~~~:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server_in_cloud:8.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server_in_cloud:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:business_intelligence:12.2.1.4.0::~~enterprise~~~:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_netcool/omnibus:8.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:curam_social_program_management:7.0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_orchestrator:2.5.0.10:*:*:*:-:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.3:p4:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.1:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201917566
    V
    		CVE-2019-17566
    2023-06-22
    oval:org.opensuse.security:def:8070
    P
    		xmlgraphics-batik-1.15-150200.4.4.3 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:3685
    P
    		Security update for wavpack (Low)
    2022-08-05
    oval:org.opensuse.security:def:3697
    P
    		libvirt-5.1.0-11.10 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:2998
    P
    		DirectFB-1.7.1-6.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3047
    P
    		cvs-1.12.12-182.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3037
    P
    		cpio-2.11-36.3.4 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3045
    P
    		cups-pk-helper-0.2.5-5.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3007
    P
    		apache-commons-beanutils-1.9.2-3.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3031
    P
    		chrony-2.3-5.6.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:2956
    P
    		java-11-openjdk-11.0.15.0-150000.3.80.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2978
    P
    		libXfixes-devel-6.0.0-150400.1.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2960
    P
    		kernel-64kb-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2992
    P
    		libXxf86vm-devel-1.1.4-1.23 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2966
    P
    		less-590-150400.1.51 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:113599
    P
    		xmlgraphics-batik-1.14-2.5 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:64594
    P
    		Security update for python-Pygments (Important)
    2021-10-20
    oval:org.opensuse.security:def:65597
    P
    		Security update for git (Low)
    2021-10-06
    oval:org.opensuse.security:def:106983
    P
    		xmlgraphics-batik-1.14-2.5 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:64754
    P
    		Security update for qemu (Moderate)
    2021-08-27
    oval:org.opensuse.security:def:63442
    P
    		libvorbis0-32bit-1.3.6-4.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:64696
    P
    		Security update for postgresql13 (Moderate)
    2021-05-27
    oval:org.opensuse.security:def:64486
    P
    		Security update for permissions (Important)
    2021-05-04
    oval:org.opensuse.security:def:64487
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:63149
    P
    		dpdk-17.11.2-1.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62946
    P
    		cvs-1.12.12-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72297
    P
    		libraptor-devel-2.0.15-1.42 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62939
    P
    		build-20200124.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62971
    P
    		pam-devel-32bit-1.3.0-6.16.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62943
    P
    		crash-7.2.8-16.19 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63645
    P
    		xorg-x11-server-wayland-1.20.3-20.11 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72181
    P
    		libpango-1_0-0-32bit-1.40.14-1.41 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:18293
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18559
    P
    		Security update for libcgroup (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64350
    P
    		libmpfr6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:52068
    P
    		Security update for cups (Important)
    2020-12-01
    oval:org.opensuse.security:def:18199
    P
    		Fixing security issues on OBS toolchain (Important)
    2020-12-01
    oval:org.opensuse.security:def:49619
    P
    		evince on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18174
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:50463
    P
    		Security update for expat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18417
    P
    		Security update for freerdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:19137
    P
    		Security update for Mesa (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63792
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:64866
    P
    		Security update for ceph (Important)
    2020-12-01
    oval:org.opensuse.security:def:18465
    P
    		Security update for krb5 (Important)
    2020-12-01
    oval:org.opensuse.security:def:18057
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:52130
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49474
    P
    		libvpx-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18376
    P
    		Security update for librelp (Important)
    2020-12-01
    oval:org.opensuse.security:def:65507
    P
    		Security update for bluez (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50068
    P
    		libecpg6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50792
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:18350
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18477
    P
    		Security update for shibboleth-sp (Important)
    2020-12-01
    oval:org.opensuse.security:def:19163
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49473
    P
    		libvdpau-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:19288
    P
    		Security update for libexif (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18230
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:18499
    P
    		Security update for xmltooling (Important)
    2020-12-01
    oval:org.opensuse.security:def:49824
    P
    		checkbashisms on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18616
    P
    		Security update for jasper (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18208
    P
    		Security update for postgresql96 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50553
    P
    		Security update for bluez (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18527
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:68841
    P
    		Security update for go1.12 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18015
    P
    		Security update for Botan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64021
    P
    		Security update for python-cffi, python-cryptography (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74808
    P
    		Security update for python-PyYAML (Important)
    2020-12-01
    oval:org.opensuse.security:def:18628
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:18142
    P
    		Security update for postgresql96 (Important)
    2020-12-01
    oval:org.opensuse.security:def:50623
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:49492
    P
    		vino on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18408
    P
    		Security update for librsvg (Low)
    2020-12-01
    oval:org.opensuse.security:def:19314
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50225
    P
    		freerdp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18381
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18650
    P
    		Security update for rpm (Important)
    2020-12-01
    oval:org.opensuse.security:def:50688
    P
    		Security update for nfs-utils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:68944
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18023
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:74941
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18166
    P
    		Security update for xerces-j2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18266
    P
    		Security update for tcpdump, libpcap (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49970
    P
    		openssh-fips on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50719
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:100208
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-07-23
    oval:org.opensuse.security:def:93495
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-07-23
    oval:org.opensuse.security:def:126120
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-06-30
    oval:org.opensuse.security:def:110603
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-06-22
    oval:org.opensuse.security:def:104618
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-06-19
    oval:org.opensuse.security:def:97928
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-06-19
    oval:org.opensuse.security:def:75324
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-06-19
    oval:org.opensuse.security:def:90963
    P
    		Security update for xmlgraphics-batik (Moderate)
    2020-06-19
    BACK
    apache batik 1.12
    ibm websphere application server 8.0
    ibm websphere application server 8.5
    ibm tivoli monitoring 6.3.0.2
    ibm tivoli monitoring 6.3.0.3
    ibm tivoli monitoring 6.3.0.4
    oracle api gateway 11.1.2.4.0
    ibm tivoli monitoring 6.3.0.5
    ibm tivoli monitoring 6.3.0.6
    ibm websphere application server 9.0
    ibm tivoli monitoring 6.3.0.7
    oracle retail order broker cloud service 15.0
    oracle retail order broker cloud service 16.0
    oracle enterprise repository 11.1.1.7.0
    oracle business intelligence 12.2.1.3.0
    ibm websphere application server in cloud 8.5
    ibm websphere application server in cloud 9.0
    oracle business intelligence 12.2.1.4.0
    ibm tivoli netcool/omnibus 8.1.0
    ibm qradar security information and event manager 7.3.0
    ibm curam social program management 7.0.5.0
    ibm cloud orchestrator 2.5.0.10
    ibm qradar security information and event manager 7.3.3 p4
    ibm qradar security information and event manager 7.4.0
    ibm qradar security information and event manager 7.4.1 -