CVE-2019-17566

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-12 · updated 2026-06-17
Weakness: CWE-918

Description

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Affected products

Apache Software Foundation Apache Batik: before 1.13 — fixed in 1.13
Oracle Corporation API Gateway: 11.1.2.4.0
Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
Oracle Communications Application Session Controller: 3.9m0p2
Oracle Communications Metasolv Solution: from 6.3.0 through 6.3.1
Oracle Communications Offline Mediation Controller: 12.0.0.3.0
Oracle Corporation Enterprise Repository: 11.1.1.7.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.0
Oracle Corporation Fusion Middleware MapViewer: 12.2.1.4.0
Oracle Corporation Oracle Hospitality OPERA 5: 5.5, 5.6
Oracle Corporation Oracle Hyperion Financial Reporting: 11.1.2.4, 11.2.5.0
Oracle Instantis Enterprisetrack: from 17.1 through 17.3
Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.4.0; 9.2.4.2 — fixed in 9.2.4.0
Oracle Corporation Oracle Retail Integration Bus: 15.0.3
Oracle Retail Order Broker: 15.0, 16.0
Oracle Retail Order Management System Cloud Service: 19.5
Oracle Corporation Retail Point-of-Service: 14.1
Oracle Corporation Retail Returns Management: 14.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Batik 1.13; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-17566 or the next vulnerability affects your stack