Code Injection in Batik XML - CVE-2022-42890

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU68827

Code Injection in Batik XML - CVE-2022-42890

Published: October 30, 2022


Vulnerability identifier: #VU68827
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-42890
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to the application allows running Java classes via JavaScript. A remote user can use JavaScript to execute a Java class on the system and obtain its execution results.

Example:

Runtime.getRuntime().exec("xxx");


Affected software

Batik XML
Amazon Linux AMI
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Oracle Solaris Cluster
Ubuntu
Development Tools Module
openSUSE Leap
openEuler
IBM Business Automation Workflow
Confluence Data Center
Jira Software Data Center
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Oracle Enterprise Data Quality
Oracle Communications EAGLE Element Management System
Oracle Agile Engineering Data Management
Oracle Financial Services Analytical Applications Infrastructure
Oracle Business Intelligence Enterprise Edition
Oracle FLEXCUBE Universal Banking
Oracle Banking Digital Experience
Confluence Server
Jira Software Server
IBM Case Manager
IBM Qradar SIEM
Oracle WebLogic Server
Fuse
Oracle Business Process Management Suite
Oracle Fusion Middleware MapViewer
Oracle Banking Corporate Lending Process Management
Oracle Banking Liquidity Management
Oracle Banking Trade Finance Process Management
Oracle Banking Branch
Oracle Banking Cash Management
Oracle Banking Supply Chain Finance
Oracle Banking Credit Facilities Process Management
libbatik-java (Ubuntu package)
batik
batik-help
batik (Debian package)
dev-java/batik
xmlgraphics-batik
xmlgraphics-batik-javadoc
xmlgraphics-batik-demo
xmlgraphics-batik-css
xmlgraphics-batik-rasterizer
xmlgraphics-batik-squiggle
xmlgraphics-batik-ttf2svg
xmlgraphics-batik-svgpp
xmlgraphics-batik-slideshow
Red Hat Camel for Spring Boot

How to mitigate CVE-2022-42890

Install updates from vendor's website.

Batik XML - update to 1.16
Confluence Server - update to 7.19.16
Confluence Data Center - update to 7.19.16
Jira Software Server - addressed in versions 9.4.16, 9.8.0
Jira Software Data Center - addressed in versions 9.4.16, 9.8.0
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
libbatik-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.10-2~18.04.1, 1.12-1ubuntu0.1, 1.14-1ubuntu0.2, 1.14-2ubuntu0.1
batik - update to 1.7-10.10
batik - update to 1.10-7
batik-help - update to 1.10-7
batik (Debian package) - update to 1.12-4+deb11u1
dev-java/batik - update to 1.17
xmlgraphics-batik - addressed in versions 1.17-2.7.1, 1.17-150200.4.7.1
xmlgraphics-batik-javadoc - update to 1.17-150200.4.7.1
xmlgraphics-batik-demo - update to 1.17-150200.4.7.1
xmlgraphics-batik-css - update to 1.17-150200.4.7.1
xmlgraphics-batik-rasterizer - update to 1.17-150200.4.7.1
xmlgraphics-batik-squiggle - update to 1.17-150200.4.7.1
xmlgraphics-batik-ttf2svg - update to 1.17-150200.4.7.1
xmlgraphics-batik-svgpp - update to 1.17-150200.4.7.1
xmlgraphics-batik-slideshow - update to 1.17-150200.4.7.1
Red Hat Camel for Spring Boot - update to 3.20.1
IBM Case Manager - update to 5.3.3-IF011
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
Fuse - update to 7.12.0

External References

Related Security Bulletins