← Back to CVE List
Vulnerability Intelligence Report

CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

No Active Exploit Signals
CVSS Base Score
8.2
HIGH
EPSS Probability:13.63%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
Authentication
Weaponization
SSVC Action

Affected Products & Versions

Vendor Product Affected Versions
apache batik all
fedoraproject fedora 33, 34
oracle agile_engineering_data_management 6.2.1.0
oracle banking_apis 18.3, 19.1, 19.2, 20.1, 21.1
oracle banking_digital_experience 18.3, 19.1, 19.2, 20.1, 21.1
oracle communications_application_session_controller 3.9m0p3
oracle communications_metasolv_solution 6.3.0, 6.3.1
oracle communications_offline_mediation_controller 12.0.0.3.0
oracle enterprise_repository 11.1.1.7.0
oracle flexcube_universal_banking all
oracle fusion_middleware_mapviewer 12.2.1.4.0
oracle instantis_enterprisetrack 17.1, 17.2, 17.3
oracle insurance_policy_administration all
oracle product_lifecycle_analytics 3.6.1
oracle retail_back_office 14.1
oracle retail_central_office 14.1
oracle retail_order_broker 15.0, 16.0
oracle retail_order_management_system_cloud_service 19.5
oracle retail_point-of-service 14.1
oracle retail_returns_management 14.1
oracle weblogic_server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
debian debian_linux 10.0

References & Technical Advisories

No reference links found.

Threat Intelligence Signals

EPSS Score
13.635%

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityApache Software Foundation · Vendor · USA
Reserved2020-04-21T00:00:00
Published2021-02-24T00:00:00
Last Updated2025-11-03T19:25:28

LINK COPIED TO CLIPBOARD