CVE-2018-8013
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the in
In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
CRITICAL · CVSS 9.8
EPSS 0.01232
Schedule remediation
- CVSS base score ≥ 7.0
Sigma rules0
YARA rules0