CVE-2022-1379

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
plantuml	plantuml/plantuml	>= unspecified, < V1.2022.5

References

Timeline

Published: May 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-13805.4Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is c CVE-2022-13817.8global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software CVE-2022-13825.5NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, t CVE-2022-13836.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the CVE-2022-13848.8Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allow CVE-2022-13854.6Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, wh CVE-2022-13869.8The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to CVE-2022-13874.8The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perfo CVE-2022-13889.8On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-13894.3On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vu CVE-2022-13909.8The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthe CVE-2022-13919.8The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whic