CVE-2022-1767

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

• CWE-918
• CWE-918

• https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdfPatch, Third Party Advisory
• https://huntr.dev/bounties/b1ce040c-9ed1-4d36-9b48-82df42310868Exploit, Third Party Advisory
• https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdfPatch, Third Party Advisory
• https://huntr.dev/bounties/b1ce040c-9ed1-4d36-9b48-82df42310868Exploit, Third Party Advisory

Published

May 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1761The Peter’s Collaboration E-mails WordPress plugin through 2…6.5
• CVE-2022-1762The iQ Block Country WordPress plugin before 1.2.20 does not…7.5
• CVE-2022-1763Due to missing checks the Static Page eXtended WordPress plu…5.4
• CVE-2022-1764The WP-chgFontSize WordPress plugin through 1.8 does not hav…5.4
• CVE-2022-1765The Hot Linked Image Cacher WordPress plugin through 1.16 is…8.8
• CVE-2022-1766Anchore Enterprise anchorectl version 0.1.4 improperly store…7.5
• CVE-2022-1768The RSVPMaker plugin for WordPress is vulnerable to unauthen…7.5
• CVE-2022-1769Buffer Over-read in GitHub repository vim/vim prior to 8.2.4…7.8
• CVE-2022-1770Improper Privilege Management in GitHub repository polonel/t…8.8
• CVE-2022-1771Uncontrolled Recursion in GitHub repository vim/vim prior to…5.5
• CVE-2022-1772The Google Places Reviews WordPress plugin before 2.0.0 does…4.8
• CVE-2022-1773The WP Athletics WordPress plugin through 1.1.7 does not san…6.1