Sunday, May 4, 2025
Homecyber securityApache XML Graphics Batik Flaw Exposes Sensitive Information

Apache XML Graphics Batik Flaw Exposes Sensitive Information

Published on

SIEM as a Service

Follow Us on Google News

Two Server-Side Request Forgery (SSRF) vulnerabilities were found in Apache Batik, which could allow a threat actor to access sensitive information in Apache Batik.

These vulnerabilities exist in the Apache XML Graphics Batik and are given CVE IDs CVE-2022-44729 and CVE-2022-44730.

It is a Java-based application toolkit that is used for rendering, generating, and manipulating of SVG (Scalable Vector Graphics) format.

- Advertisement - Google News

This tool contains multiple modules like SVG Parser, SVG Generator, and SVG DOM.

CVE-2022-44729 & CVE-2022-44730 Apache Batik Flaw

CVE-2022-44729, One of the SSRF vulnerabilities exists as Apache can be triggered to load external resources by using a malicious SVG, which could result in more resource consumption or information disclosure.

CVE-2022-44730, this vulnerability can be exploited by a threat actor by using a malicious SVG to probe user profile/data and send it directly as an URL parameter resulting in information disclosure.

In response to these vulnerabilities, Apache has patched these vulnerabilities by blocking external resources by default and creating a whitelist in the Rhino JS engine.

Batik prior to version 1.16, is affected by these vulnerabilities. Revisions have been made to the source code of Batik to fix these vulnerabilities. 

Users of Apache Batik are recommended to upgrade to the latest version 1.17, to prevent this vulnerability from getting exploited. 

Keep yourself informed about the latest Cyber Security News by following us on GoogleNewsLinkedinTwitter, and Facebook.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Threat Actors Target Critical National Infrastructure with New Malware and Tools

A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated,...

New StealC V2 Upgrade Targets Microsoft Installer Packages and PowerShell Scripts

StealC, a notorious information stealer and malware downloader first sold in January 2023, has...

Subscription-Based Scams Targeting Users to Steal Credit Card Information

Cybersecurity researchers at Bitdefender have identified a significant uptick in subscription-based scams, characterized by...

RansomHub Taps SocGholish: WebDAV & SCF Exploits Fuel Credential Heists

SocGholish, a notorious loader malware, has evolved into a critical tool for cybercriminals, often...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Threat Actors Target Critical National Infrastructure with New Malware and Tools

A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated,...

New StealC V2 Upgrade Targets Microsoft Installer Packages and PowerShell Scripts

StealC, a notorious information stealer and malware downloader first sold in January 2023, has...

Subscription-Based Scams Targeting Users to Steal Credit Card Information

Cybersecurity researchers at Bitdefender have identified a significant uptick in subscription-based scams, characterized by...