DEBIAN-CVE-2022-1231

    Dashboard / Vulnerabilities / DEBIAN-CVE-2022-1231

    DEBIAN-CVE-2022-1231

    Published: 15 Apr 2022Last Modified: 1 Sept 2026
    Upstream:
    CVE-2022-1231

    Summary:

    Details: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).

    References: https://security-tracker.debian.org/tracker/CVE-2022-1231

    Affected packages

    Package

    Name: plantuml

    Purl: pkg:deb/debian/plantuml?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1:1.2020.2+ds-3
    1:1.2020.2+ds-4
    1:1.2020.2+ds-5
    1:1.2020.2+ds-6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2022-1231 | CVE-DB