Information Disclosure in Apache Batik by Apache Software Foundation

CVE-2018-8013

Summary

Apache Batik versions prior to 1.10 contain a deserialization vulnerability where subclasses of AbstractDocument can lead to information disclosure. The issue arises when the class name is taken from the inputStream, allowing unauthorized constructors to be called without adequate checks. This flaw may permit malicious actors to exploit the deserialization process, leading to instances of unauthorized access to sensitive data or functionalities within the application.

References