CVE-2022-1231

    Dashboard / Vulnerabilities / CVE-2022-1231

    CVE-2022-1231

    Published: 15 Apr 2022Last Modified: 12 Aug 2026

    Summary: XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml

    Details: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).

    References: https://huntr.dev/bounties/27db9509-6cd3-4148-8d70-5942f3837604, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1231.json, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EO26WBHQRMWTS44M5VLZJIJZOIGJYL3A/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FQMHXN5BVBK433C5SVSSBXWB5JLJ7NID/, https://nvd.nist.gov/vuln/detail/CVE-2022-1231, https://github.com/plantuml/plantuml/commit/c9137be051ce98b3e3e27f65f54ec7d9f8886903

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -bee4d458ebf9a5e0eaad8f407cb916c2c577b138

    Affected versions

    v1.2022.3
    v1.2022.2
    v1.2022.1
    v1.2022.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1231 | CVE-DB