CVE-2020-11987: Server-Side Request Forgery (SSRF)

January 6, 2022

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

References

github.com/advisories/GHSA-2h63-qp69-fwvw
github.com/apache/xmlgraphics-batik/commit/0ef5b661a1f77772d1110877ea9e0287987098f6
nvd.nist.gov/vuln/detail/CVE-2020-11987

Code Behaviors & Features

Detect and mitigate CVE-2020-11987 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →