CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

CVSS 3.1

8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-25)

CWEs

CWE-20, CWE-918

Published

2021-02-24

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• apache:batik
• debian:debian_linux
• fedoraproject:fedora
• oracle:agile_engineering_data_management
• oracle:banking_apis
• oracle:banking_digital_experience
• oracle:communications_application_session_controller
• oracle:communications_metasolv_solution
• oracle:communications_offline_mediation_controller
• oracle:enterprise_repository
• oracle:flexcube_universal_banking
• oracle:fusion_middleware_mapviewer
• oracle:instantis_enterprisetrack
• oracle:insurance_policy_administration
• oracle:product_lifecycle_analytics
• oracle:retail_back_office
• oracle:retail_central_office
• oracle:retail_order_broker
• oracle:retail_order_management_system_cloud_service
• oracle:retail_point-of-service
• oracle:retail_returns_management
• oracle:weblogic_server

Packages (OSV)

References

• https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E
• https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/

Check your stackJSON