High severity · published Apr 18, 2017
CVE-2017-5662
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files
7.3
CVSS
4.1%
EPSS
No
On KEV
Description
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Batik · Apache
through 1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5662
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5662
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Third Party Advisory
http://www.securityfocus.com/bid/97948
www.securitytracker.com
http://www.securitytracker.com/id/1038334
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:2546
More from Batik
9.8
CVE-2018-8013
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the…
8.2
CVE-2020-11987
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel
7.5
CVE-2022-41704
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
7.5
CVE-2022-42890
Apache Batik prior to 1.16 allows RCE via scripting
7.5
CVE-2022-40146
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url