UBUNTU-CVE-2022-1231

    Dashboard / Vulnerabilities / UBUNTU-CVE-2022-1231

    UBUNTU-CVE-2022-1231

    Published: 15 Apr 2022Last Modified: 4 Feb 2026
    Upstream:
    CVE-2022-1231
    Aliases:
    USN-7353-1

    Summary:

    Details: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).

    References: https://ubuntu.com/security/CVE-2022-1231, https://huntr.dev/bounties/27db9509-6cd3-4148-8d70-5942f3837604/, https://github.com/plantuml/plantuml/commit/c9137be051ce98b3e3e27f65f54ec7d9f8886903, https://www.cve.org/CVERecord?id=CVE-2022-1231, https://ubuntu.com/security/notices/USN-7353-1

    Affected packages

    Package

    Name: plantuml

    Purl: pkg:deb/ubuntu/[email protected]~esm1?arch=source&distro=esm-apps/xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -8024-2ubuntu0.1~esm1

    Affected versions

    8024-2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2022-1231 | CVE-DB