ShadowTrackr

Search the CVE vulnerability database

Look up vulnerabilities by software, product or CVE number.

← Back to results

CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
An official patch is available. Apply the patch as soon as possible.
8.2
CVSS
6.9
ShadowTrackr
NO
CISA KEV
-
NCSC.nl
CVSS v4.0 Metrics
Exploitability
Attack VectorNetwork
ComplexityLow
RequirementsPresent
PrivilegesNone
User InteractionNone
Threat
Exploit MaturityPoC
Vulnerable System
ConfidentialityHigh
IntegrityLow
AvailabilityNone
Subsequent System
ConfidentialityNone
IntegrityNone
AvailabilityNone
Supplemental
SafetyNegligible
AutomatableYes
RecoveryAutomatic
Value DensityConcentrated
UrgencyMedium
Patch StatusOfficial Patch

Change Log
DateSourceChangesScore
2026-07-21PoCE: U→P4.8 → 6.9
2026-07-21nvdAV: P→N, AC: H→L, PR: H→N, UI: A→N, VC: N→H, VI: N→L0.0 → 4.8
2026-07-21nvdpatch: Unavailable→Official Patch0.0 → 0.0
2026-07-21cve.orginitial, patch: Unavailable0.0

Affected Software
VendorProductVersion
apachebatik≤ 1.13
debiandebian_linux10.0
fedoraprojectfedora33
fedoraprojectfedora34
n/aApache BatikApache Batik 1.13
oracleagile_engineering_data_management6.2.1.0
oraclebanking_apis18.3
oraclebanking_apis19.1
oraclebanking_apis19.2
oraclebanking_apis20.1
oraclebanking_apis21.1
oraclebanking_digital_experience18.3
oraclebanking_digital_experience19.1
oraclebanking_digital_experience19.2
oraclebanking_digital_experience20.1
oraclebanking_digital_experience21.1
oraclecommunications_application_session_controller3.9m0p3
oraclecommunications_metasolv_solution6.3.0
oraclecommunications_metasolv_solution6.3.1
oraclecommunications_offline_mediation_controller12.0.0.3.0
oracleenterprise_repository11.1.1.7.0
oracleflexcube_universal_banking≥ 14.1.0, ≤ 14.4.0
oraclefusion_middleware_mapviewer12.2.1.4.0
oracleinstantis_enterprisetrack17.1
oracleinstantis_enterprisetrack17.2
oracleinstantis_enterprisetrack17.3
oracleinsurance_policy_administration≥ 11.0, ≤ 11.3.1
oracleproduct_lifecycle_analytics3.6.1
oracleretail_back_office14.1
oracleretail_central_office14.1
oracleretail_order_broker15.0
oracleretail_order_broker16.0
oracleretail_order_management_system_cloud_service19.5
oracleretail_point-of-service14.1
oracleretail_returns_management14.1
oracleweblogic_server12.2.1.3.0
oracleweblogic_server12.2.1.4.0
oracleweblogic_server14.1.1.0.0
Published: 2021-02-24