CVE-2022-38648

PDFTranscoder does not block external resources

State: Published
Severity: Not scored
Published: Sep 22, 2022
Updated: Nov 3, 2025
Reserved: Aug 22, 2022

Description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Scores

The record has no CVSS score.

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Apache XML GraphicsApache Software Foundation	Batik 1.14Affected

References

https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b
[debian-lts-announce] 20231014 [SECURITY] [DLA 3619-1] batik security updatemailing-list
GLSA-202401-11vendor-advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.