CVE-2022-1379

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-1379
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1379.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-1379
Downstream
Related
Published
2022-05-14T09:55:09Z
Modified
2025-11-20T11:58:58.681412Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
URL Restriction Bypass in plantuml/plantuml
Details

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/plantuml/plantuml

Affected ranges

Type
GIT
Repo
https://github.com/plantuml/plantuml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
229a6129e2473da8227f5138f26edbb352e38376

Affected versions

v1.*

v1.2017.12
v1.2017.13
v1.2017.14
v1.2017.15
v1.2017.17
v1.2017.18
v1.2017.19
v1.2017.20
v1.2018.0
v1.2018.1
v1.2018.10
v1.2018.11
v1.2018.12
v1.2018.13
v1.2018.14
v1.2018.2
v1.2018.3
v1.2018.4
v1.2018.5
v1.2018.6
v1.2018.7
v1.2018.8
v1.2018.9
v1.2019.0
v1.2019.1
v1.2019.10
v1.2019.11
v1.2019.12
v1.2019.13
v1.2019.2
v1.2019.4
v1.2019.5
v1.2019.6
v1.2019.7
v1.2019.8
v1.2019.9
v1.2020.0
v1.2020.1
v1.2020.10
v1.2020.11
v1.2020.12
v1.2020.13
v1.2020.14
v1.2020.15
v1.2020.16
v1.2020.17
v1.2020.18
v1.2020.19
v1.2020.2
v1.2020.20
v1.2020.21
v1.2020.22
v1.2020.23
v1.2020.24
v1.2020.26
v1.2020.3
v1.2020.4
v1.2020.6
v1.2020.7
v1.2020.8
v1.2020.9
v1.2021.0
v1.2021.1
v1.2021.10
v1.2021.12
v1.2021.13
v1.2021.14
v1.2021.15
v1.2021.16
v1.2021.2
v1.2021.3
v1.2021.4
v1.2021.5
v1.2021.6
v1.2021.7
v1.2021.8
v1.2021.9
v1.2022.0
v1.2022.1
v1.2022.2
v1.2022.3
v1.2022.4

v2017.*

v2017.08
v2017.09
v2017.11

Other

v8059

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "test/net/sourceforge/plantuml/security/SURLTest.java"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/229a6129e2473da8227f5138f26edbb352e38376",
        "digest": {
            "line_hashes": [
                "196264472814800741060603148441232717978",
                "276534186818838624058782349229553771726",
                "228068663217648557685707576066358518591",
                "132462165622317319281114704777089076480",
                "274810568477027801438125860551311888240",
                "289304651679670439044352821383488975628",
                "180908644323663739383706755014823285724"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-1379-93b7683b"
    }
]