CVE-2022-1379

URL Restriction Bypass in plantuml/plantuml

CVSS 7.2 HIGHEPSS 1.5%CWE-918

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.2EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

14 mai 2022Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Produtos afetados

plantuml · plantuml/plantuml

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083 https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/