CVE-2022-1711

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.

• CWE-918
• CWE-918

• https://github.com/jgraph/drawio/commit/cf5c78aa0f3127fb10053db55b39f3017a0654aePatch, Third Party Advisory
• https://huntr.dev/bounties/c32afff5-6ad5-4d4d-beea-f55ab4925797Exploit, Patch, Third Party Advisory
• https://github.com/jgraph/drawio/commit/cf5c78aa0f3127fb10053db55b39f3017a0654aePatch, Third Party Advisory
• https://huntr.dev/bounties/c32afff5-6ad5-4d4d-beea-f55ab4925797Exploit, Patch, Third Party Advisory

Published

May 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1705Acceptance of some invalid Transfer-Encoding headers in the …6.5
• CVE-2022-1706A vulnerability was found in Ignition where ignition configs…6.5
• CVE-2022-1707The Google Tag Manager for WordPress plugin for WordPress is…6.1
• CVE-2022-1708A vulnerability was found in CRI-O that causes memory or dis…7.5
• CVE-2022-1709The Throws SPAM Away WordPress plugin before 3.3.1 does not …4.3
• CVE-2022-1710The Appointment Hour Booking WordPress plugin before 1.3.56 …4.8
• CVE-2022-1712The LiveSync for WordPress plugin through 1.0 does not have …4.3
• CVE-2022-1713SSRF on /proxy in GitHub repository jgraph/drawio prior to 1…7.5
• CVE-2022-1714Out-of-bounds Read in GitHub repository radareorg/radare2 pr…7.1
• CVE-2022-1715Account Takeover in GitHub repository neorazorx/facturascrip…9.8
• CVE-2022-1716Keep My Notes v1.80.147 allows an attacker with physical acc…4.6
• CVE-2022-1717The Custom Share Buttons with Floating Sidebar WordPress plu…4.8