CVE-2022-1379highCWE-918

CVE-2022-1379: falha de alta gravidade em plantuml/plantuml

URL Restriction Bypass in plantuml/plantuml

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar plantuml/plantuml

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 1.6%
URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
plantuml · plantuml/plantuml
CVEs relacionadas — plantuml/plantuml

No mesmo produto, das mais perigosas para as menos.

CVE-2022-1231CRITICALXSS via Embedded SVG in SVG Diagram Format in plantuml/plantumlEPSS 2.0%CVE-2023-3432HIGHServer-Side Request Forgery (SSRF) in plantuml/plantumlEPSS 0.9%CVE-2023-3431MEDIUMImproper Access Control in plantuml/plantumlEPSS 0.9%