CVE-2023-3431

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-3431
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3431.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-3431
Aliases
Downstream
Published
2023-06-27T14:28:33.739Z
Modified
2026-07-22T02:25:08.810028Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Improper Access Control in plantuml/plantuml
Details

Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "@huntrdev",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3431.json"
}
References

Affected packages

Git / github.com/plantuml/plantuml

Affected ranges

Type
GIT
Repo
https://github.com/plantuml/plantuml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
74574c4f57d8d56b0e740b64e3d005ed071b2da2
Fixed
fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e
Database specific 
{
    "cpe": "cpe:2.3:a:plantuml:plantuml:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2023.9"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.2017.12
v1.2017.13
v1.2017.14
v1.2017.15
v1.2017.17
v1.2017.18
v1.2017.19
v1.2017.20
v1.2018.0
v1.2018.1
v1.2018.10
v1.2018.11
v1.2018.12
v1.2018.13
v1.2018.14
v1.2018.2
v1.2018.3
v1.2018.4
v1.2018.5
v1.2018.6
v1.2018.7
v1.2018.8
v1.2018.9
v1.2019.0
v1.2019.1
v1.2019.10
v1.2019.11
v1.2019.12
v1.2019.13
v1.2019.2
v1.2019.4
v1.2019.5
v1.2019.6
v1.2019.7
v1.2019.8
v1.2019.9
v1.2020.0
v1.2020.1
v1.2020.10
v1.2020.11
v1.2020.12
v1.2020.13
v1.2020.14
v1.2020.15
v1.2020.16
v1.2020.17
v1.2020.18
v1.2020.19
v1.2020.2
v1.2020.20
v1.2020.21
v1.2020.22
v1.2020.23
v1.2020.24
v1.2020.26
v1.2020.3
v1.2020.4
v1.2020.6
v1.2020.7
v1.2020.8
v1.2020.9
v1.2021.0
v1.2021.1
v1.2021.10
v1.2021.12
v1.2021.13
v1.2021.14
v1.2021.15
v1.2021.16
v1.2021.2
v1.2021.3
v1.2021.4
v1.2021.5
v1.2021.6
v1.2021.7
v1.2021.8
v1.2021.9
v1.2022.0
v1.2022.1
v1.2022.10
v1.2022.11
v1.2022.12
v1.2022.13
v1.2022.14
v1.2022.2
v1.2022.3
v1.2022.4
v1.2022.5
v1.2022.6
v1.2022.7
v1.2022.8
v1.2022.9
v1.2023.0
v1.2023.1
v1.2023.2
v1.2023.3
v1.2023.4
v1.2023.5
v1.2023.6
v1.2023.7
v1.2023.8
v2017.*
v2017.08
v2017.09
v2017.11
Other
v8059

Database specific

vanir_signatures_modified 
"2026-07-22T02:25:08Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 236.0,
            "function_hash": "295671681575716211859674241965946186000"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-03ce3777",
        "target": {
            "function": "isAllowed",
            "file": "src/net/sourceforge/plantuml/preproc/ImportedFiles.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 690.0,
            "function_hash": "138628822802626236979227039996092801179"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-1317f43a",
        "target": {
            "function": "getAFile",
            "file": "src/net/sourceforge/plantuml/preproc/ImportedFiles.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "70707241394405025232645611292324547059",
                "33184566281828019193828520470734606135",
                "330816893024893871030925531994571319863",
                "123222711058072444801259751711702577633",
                "169216569462703701377612689403887150710",
                "164296879805937023173477345758877875489"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-1d3e1e32",
        "target": {
            "file": "src/net/sourceforge/plantuml/security/SecurityUtils.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "210515168564025757901942452174593943749",
                "42647438058321653966432471086781283291",
                "299904126988688993460797719245296501832",
                "49565929308389227729446955991442276313",
                "300144468707324780803554984547832280147"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-2b96d4c7",
        "target": {
            "file": "src/net/sourceforge/plantuml/version/LicenseInfo.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "256324481792485760998147825627873189046",
                "56670958834994939275063077501557678368",
                "219476885066342344978352977205319928725",
                "154477007438697345736117732853958923194",
                "91728285534948167562085535601275237730",
                "55751362714565935488529242582043814312",
                "71561401465696932291825548434158969335",
                "119339270261288956678926877825755755296",
                "43944486058659702562709498546605711598",
                "37726833807991586763368742142935277593"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-369ca7e1",
        "target": {
            "file": "src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "207701546150694293457764529566779027295",
                "49998310382257502309661894804057749292",
                "20851392022704228181869660779157628851",
                "61428248874584237710679155953971327601",
                "72491200449950197554336271922686797630",
                "1302932659165008021984175783386694081",
                "59493212917515536409049326213577935145",
                "294332292924590892416795118073067109472",
                "282696667324840721204512968210578349555",
                "22005330921324990935255213380539087483"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-3afcd3f6",
        "target": {
            "file": "src/net/sourceforge/plantuml/security/SFile.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 321.0,
            "function_hash": "140381737713758724605074770456806974462"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-3f3c6473",
        "target": {
            "function": "executeReturnFunction",
            "file": "src/net/sourceforge/plantuml/tim/stdlib/FileExists.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "82593515397456814300391935582543520124",
                "313415320249935561359134811076297426228",
                "336089327203033597315652734706478387688",
                "265208622713820745245680475319345505020",
                "20440202004088442185537029183168373737",
                "319056913707537841550743455411537274762",
                "317025510414475158580729168947528632641",
                "36752952804877926969540623272616707617",
                "144520977893402479958342481011896218944",
                "299874491427917706642685036803308437662",
                "235083652034081260396488619040881188604",
                "161565944219854835206668842481557221699",
                "28160429125185869293644279760745859370",
                "60332093068620864210802371266731648937",
                "2350722975721544610355528506150369035",
                "214011167471722682788498676846667002945",
                "325411890094493482094935932493359103563",
                "209655304996599417207222385990335161059"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-414cbfc4",
        "target": {
            "file": "src/net/sourceforge/plantuml/tim/stdlib/Getenv.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "256661365122838826541229538519975137226",
                "269182912484056040645781467191056859478",
                "334380381096962201455575632387985494433",
                "321237904051611807903460296685104223679",
                "339091294525818687170787306364855532068",
                "173312891188850722156529215430359715531",
                "133009306440247803659936845538869081182"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-4567675e",
        "target": {
            "file": "src/net/sourceforge/plantuml/OptionFlags.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 889.0,
            "function_hash": "132902297885041549482302335456219754968"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-532cfcd4",
        "target": {
            "function": "loadStringData",
            "file": "src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 418.0,
            "function_hash": "232988119417391698118153901512236415946"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-543e957e",
        "target": {
            "function": "getFile",
            "file": "src/net/sourceforge/plantuml/preproc/ImportedFiles.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 46.0,
            "function_hash": "298906704308918028270331362808751815864"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/74574c4f57d8d56b0e740b64e3d005ed071b2da2",
        "id": "CVE-2023-3431-61a93759",
        "target": {
            "function": "compileTime",
            "file": "src/net/sourceforge/plantuml/version/Version.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 102.0,
            "function_hash": "298270292869139346311858303540944568845"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-6d3e9182",
        "target": {
            "function": "fileExists",
            "file": "src/net/sourceforge/plantuml/tim/stdlib/FileExists.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "82593515397456814300391935582543520124",
                "259071242154017647817266854090332040831",
                "102907114775737697299545405613640593236",
                "256288078075804964226751176419569512436",
                "20440202004088442185537029183168373737",
                "16025080765642744650800131214978971634",
                "332984626192607288916267510945251842187",
                "64037390207966777852281179541626316459",
                "236706024146421916098827135588526484031",
                "263610246405184061900057008755593491295",
                "254304674096324767724913406458884932549",
                "111360325776344402221566404809680150037",
                "300705604461297422664375869975930930724",
                "166663623295691456667291761128086881179"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-7a8313e6",
        "target": {
            "file": "src/net/sourceforge/plantuml/tim/stdlib/FileExists.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "56949855484150835526612283684283291174",
                "265392703532280520950264384671054040806",
                "6803911083789494355353244297916585757",
                "327469427453145885280404479856877502844",
                "244902243605055210223401873028024132199",
                "279951063791932336170053476838804510128",
                "29388838813876182059337822229462940638",
                "187819651984175543791182808951285148521",
                "295959386967973516174945480457435087832",
                "159349555200058470202806094528970847911",
                "108240105133723627099060709658939598924",
                "127782862217254761269936934668076971494",
                "59052435771900421166625907570357164307",
                "276309807914591996745129672896645271503",
                "169065640376995106552565359336806591695",
                "18321886824673264660496606007064193042",
                "12368409499950536014244685444513064683",
                "300494571825683785108002603307203727235",
                "276879104745036673049884269798260459858",
                "113464502699799428400251939486541662673",
                "33812934817492734255422475051078328923",
                "131244216260185356245174468049987455949",
                "221839162269801483932316022497096549976",
                "57300733303693924943034773470830469561",
                "329524587727411810043077594362659370560",
                "280434648638475190715350236724113811433",
                "47057960724269376676228255578960603791",
                "41666661399088622198356775952724313475",
                "225368559426216035357218852858830102477",
                "202256101183492912784465210192016089907",
                "243983355331013546633973380607093987514",
                "28123310583431867020681111686092985307",
                "177084753405953219210419930347919217638",
                "231579835506902227128991393413389935150",
                "39024790900162186604499432487950608000",
                "113947080962230820824868449430164825177",
                "196628377364554255280769565920165561577",
                "276495015671494883802000744508442132315",
                "212135929589335220487538839289495845660",
                "335368997064465428931056375056340718651",
                "114007619688918933356691788873886209432",
                "273463136551954460076211149584112224343",
                "109416286277006706283624019440632264218",
                "255816151399732581934478869438162816683",
                "158455586583586267483278495823598955306",
                "119258988697698457769296765622298402469",
                "183325986263730029783145769233746546977"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-864f524f",
        "target": {
            "file": "src/net/sourceforge/plantuml/preproc/ImportedFiles.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 599.0,
            "function_hash": "207812479234444210551312523707171617433"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-90b1556d",
        "target": {
            "function": "retrieveNamedSlow",
            "file": "src/net/sourceforge/plantuml/version/LicenseInfo.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "115567330883225380095908451708534079799",
                "58586099198746526428922845814069807432",
                "10224432396185652366955444417416007964",
                "253069242297305364447713446666003222049"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-974623cc",
        "target": {
            "file": "src/net/sourceforge/plantuml/security/SURL.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 207.0,
            "function_hash": "227436296115628258863052872776064856333"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-ab65cf85",
        "target": {
            "function": "getenv",
            "file": "src/net/sourceforge/plantuml/tim/stdlib/Getenv.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 102.0,
            "function_hash": "229355450937196715787033816876086413210"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-af8069c4",
        "target": {
            "function": "fromFile",
            "file": "src/net/sourceforge/plantuml/security/SFile.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14934490649173339046758351618916252057",
                "225017555877350499898537590575365893894",
                "92320211777360893020139242437988741148",
                "175469732990037397488314804882350027082",
                "299581856334850311314440181812613330775",
                "190152119231407986887396244796169323045"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-cf801746",
        "target": {
            "file": "src/net/sourceforge/plantuml/version/PSystemVersion.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 46.0,
            "function_hash": "10943004671823213165319022274164867147"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-d34ecdda",
        "target": {
            "function": "setAllowIncludeFalse",
            "file": "src/net/sourceforge/plantuml/OptionFlags.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 394.0,
            "function_hash": "250027776545232403304145555823018668682"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-d809f24c",
        "target": {
            "function": "executeReturnFunction",
            "file": "src/net/sourceforge/plantuml/tim/stdlib/Getenv.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "281324789247698788548279453367432578435",
                "94002024686682539203048910157257185379",
                "98755750175637519147830449997773954952",
                "207058946847568256688335705263149081387"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-dd132dab",
        "target": {
            "file": "src/net/sourceforge/plantuml/version/Version.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 113.0,
            "function_hash": "318761476468489491630251270923689490079"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-df94a6f1",
        "target": {
            "function": "withCurrentDir",
            "file": "src/net/sourceforge/plantuml/preproc/ImportedFiles.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "146867373125416096968169019915169602019",
                "320494320065182875017058654916922282389",
                "324161394208363568244320877044827652010",
                "34278620398819972444563889680577394316",
                "90120288795734310982317362690670181298",
                "280230260526823074946512142599682136304",
                "91068408516048719293487979281481862466",
                "258655926181888410938968616109502645971"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/74574c4f57d8d56b0e740b64e3d005ed071b2da2",
        "id": "CVE-2023-3431-e20c112d",
        "target": {
            "file": "src/net/sourceforge/plantuml/version/Version.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "306569140673987385794977228684192182619",
                "270611022736580468435939800776465817327",
                "58501737963627570515060834958563219769"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-e8bae942",
        "target": {
            "file": "src/net/sourceforge/plantuml/security/SecurityProfile.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1073.0,
            "function_hash": "8012712777885011920703251645706405268"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-eb537283",
        "target": {
            "function": "createShowVersion2",
            "file": "src/net/sourceforge/plantuml/version/PSystemVersion.java"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 117.0,
            "function_hash": "246687984861559636101252976924831127487"
        },
        "signature_version": "v1",
        "source": "https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e",
        "id": "CVE-2023-3431-fd783e89",
        "target": {
            "function": "isSecurityEnv",
            "file": "src/net/sourceforge/plantuml/security/SecurityUtils.java"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3431.json"