CVE-2020-11987

HighCVSS 8.2

Published: 24/02/2021(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

13.28%

96th percentile - higher than 96% of all known CVEs

Summary

Apache Batik 1.13 is vulnerable to server-side request forgery caused by improper input validation in the NodePickerPanel. An attacker can exploit this with a specially crafted argument to make the server perform arbitrary GET requests.

Risk Assessment

Ability to make unauthorized requests to internal network resources, potentially leading to data disclosure or further attacks.

Recommendation

Update Apache Batik to a version that includes a fix for this vulnerability.

Other vulnerabilities in Apache Batik

CVE-2017-5662High
In Apache Batik before version 1.9, there is a vulnerability that allows files on the server's filesystem to be revealed to users who send maliciously crafted SVG files. The types of files that can be exposed depend on the user context in which the application is running.

Original NVD description (English source)

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS