CVE-2022-1379 is a critical URL Restriction Bypass vulnerability affecting PlantUML versions prior to V1.2022.5, including various Fedora Project distributions. This flaw allows an attacker to bypass security profiles and achieve Server-Side Request Forgery (SSRF), enabling access to internal resources or third-party servers. With a CVSS score of 9.1 (CRITICAL), it requires no user interaction or privileges, making it easily exploitable over the network. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2022.5CPE matchmatch criteria | cpe:2.3:a:plantuml:plantuml:*:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.