CVE-2022-1379

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

• CWE-918
• CWE-918

• https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083Patch, Third Party Advisory
• https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063aExploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/
• https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083Patch, Third Party Advisory
• https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063aExploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/

Published

May 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1373The “restore configuration” feature of Softing Secure Integr…7.2
• CVE-2022-1374Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-1375Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-1376Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-1377Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-1378Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-1380Stored Cross Site Scripting vulnerability in Item name param…5.4
• CVE-2022-1381global heap buffer overflow in skip_range in GitHub reposito…7.8
• CVE-2022-1382NULL Pointer Dereference in GitHub repository radareorg/rada…5.5
• CVE-2022-1383Heap-based Buffer Overflow in GitHub repository radareorg/ra…6.1
• CVE-2022-1384Mattermost version 6.4.x and earlier fails to properly check…8.8
• CVE-2022-1385Mattermost 6.4.x and earlier fails to properly invalidate pe…4.6