CVE-2022-1379highCWE-918

CVE-2022-1379: high-severity vulnerability in plantuml/plantuml

URL Restriction Bypass in plantuml/plantuml

Published · Updated

Follow this CVE+ Monitor plantuml/plantuml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 1.6%
URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
plantuml · plantuml/plantuml
Related CVEs — plantuml/plantuml

In the same product, most dangerous first.

CVE-2022-1231CRITICALXSS via Embedded SVG in SVG Diagram Format in plantuml/plantumlEPSS 2.0%CVE-2023-3432HIGHServer-Side Request Forgery (SSRF) in plantuml/plantumlEPSS 0.9%CVE-2023-3431MEDIUMImproper Access Control in plantuml/plantumlEPSS 0.9%