CVE-2022-40146

Jar url should be blocked by DefaultScriptSecurity

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Affected

Apache Software Foundation · Apache XML Graphics

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

7.43% chance of exploitation in the next 30 days, 94th percentile

Published

2022-09-22

Updated

2025-11-03

Proof-of-concept exploits (2)

• cckuailong/CVE-2022-40146_Exploit_Jar31★ · 2022-11-01
• soulfoodisgood/CVE-2022-401460★ · 2024-07-30

Security advisories

• https://lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx
• advisories/GHSA-h4qg-p7r2-cpg3

References

• CVE Record
• NVD entry

Related

• CVE-2021-2471
• CVE-2021-39149
• CVE-2021-44832
• CVE-2021-45046
• CVE-2021-45105