Vulnerability Details : CVE-2022-1379
URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2022-1379
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- cpe:2.3:a:plantuml:plantuml:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-1379
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-1379
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST | |
7.2
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
3.9
|
2.7
|
huntr.dev | |
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
3.9
|
5.2
|
NIST |
CWE ids for CVE-2022-1379
-
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.Assigned by:
- nvd@nist.gov (Primary)
- security@huntr.dev (Secondary)
References for CVE-2022-1379
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/
[SECURITY] Fedora 35 Update: plantuml-1.2022.5-1.fc35 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083
Import version 1.2022.5 · plantuml/plantuml@93e5964 · GitHubPatch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/
[SECURITY] Fedora 36 Update: plantuml-1.2022.5-1.fc36 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a
URL Restriction Bypass vulnerability found in plantumlExploit;Patch;Third Party Advisory
Jump to