CVE-2022-38398 Server-Side Request Forgery Information Disclosure Vulnerability

What is CVE-2022-38398?

CVE-2022-38398 is a medium-severity server-side request forgery vulnerability in Debian Debian Linux, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

Weakness: CWE-918

Which versions are affected by CVE-2022-38398?

4 open source packages ship an affected version, including org.apache.xmlgraphics:batik and org.apache.xmlgraphics:batik-bridge. It affects 2 products.

Products include Apache Batik, Debian Debian Linux.

How do I fix CVE-2022-38398?

Upgrade org.apache.xmlgraphics:batik to 1.15 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-38398 being exploited?

There is no known exploitation of CVE-2022-38398 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik Critical 9.8
• CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik High 8.2
• CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input High 7.5
• CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting High 7.5
• CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-38398, GHSA-c5xv-qc8p-mh2v, UBUNTU-CVE-2022-38398.