What’s Vulnerable › Vulnerabilities

CVE-2022-1379: URL Restriction Bypass in plantuml/plantuml

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-14 · updated 2026-06-17
• Weakness: CWE-918

Description

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

Affected products

• Fedoraproject Fedora: 35, 36
• net.sourceforge.plantuml:plantuml: before 1.2022.5 — fixed in 1.2022.5

How to fix

Upgrade to a fixed version: net.sourceforge.plantuml:plantuml 1.2022.5. Check the vendor advisory for mitigations.

References

• https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083
• https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/
• https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083
• https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/

Get alerted when CVE-2022-1379 or the next vulnerability affects your stack