CVE-2019-17566 in Business Intelligence Enterprise Editioninfo

Summary

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservation

10/14/2019

Disclosure

11/12/2020

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

IDVulnerabilityCWEExpCouCVE
190974Oracle Business Intelligence Enterprise Edition Analytics Web Answers input validation20Not definedOfficial fixCVE-2019-17566
179132Oracle Hyperion Financial Reporting Apache Batik input validation20Not definedOfficial fixCVE-2019-17566
178977Oracle Communications Offline Mediation Controller Apache Batik server-side request forgery918Not definedOfficial fixCVE-2019-17566
173553Oracle JD Edwards EnterpriseOne Tools Web Runtime server-side request forgery918Not definedOfficial fixCVE-2019-17566
173541Oracle Hospitality OPERA 5 Integration server-side request forgery918Not definedOfficial fixCVE-2019-17566
173510Oracle Fusion Middleware MapViewer Install server-side request forgery918Not definedOfficial fixCVE-2019-17566
173503Oracle API Gateway server-side request forgery918Not definedOfficial fixCVE-2019-17566
173480Oracle Financial Services Analytical Applications Infrastructure Rate Management server-side request forgery918Not definedOfficial fixCVE-2019-17566
168415Oracle Retail Order Broker System Administration server-side request forgery918Not definedOfficial fixCVE-2019-17566
168414Oracle Retail Integration Bus RIB Kernal server-side request forgery918Not definedOfficial fixCVE-2019-17566
168307Oracle Enterprise Repository Security server-side request forgery918Not definedOfficial fixCVE-2019-17566
168179Oracle Instantis EnterpriseTrack Dashboard module server-side request forgery918Not definedOfficial fixCVE-2019-17566
168171Oracle Communications Application Session Controller Apache Batik server-side request forgery918Not definedOfficial fixCVE-2019-17566
168160Oracle Communications MetaSolv Solution Print Preview server-side request forgery918Not definedOfficial fixCVE-2019-17566
164790Apache Batik GET Request server-side request forgery918Not definedNot definedCVE-2019-17566

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

Sources

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!