CVE-2022-1713

CVE-2022-1713 affects jgraph/drawio prior to 18.0.4. The connected Nuclei template confirms a Server-Side Request Forgery (SSRF) at the /proxy endpoint, allowing an attacker to make requests as the server and read contents, enabling potential data leakage. Impact is described as reading internal ...

CVE-2022-1713 SSRF on /proxy in jgraph/drawio

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information...

CVE-2022-1721

CVE-2022-1721 affects the draw.io/jgraph WellKnownServlet. The vulnerability is a path traversal flaw in WellKnownServlet that can read local files of the web application, affecting versions prior to 18.0.5. The issue arises from serving requested resources via the servlet, enabling disclosure of...

CVE-2022-1721 Path Traversal in WellKnownServlet in jgraph/drawio

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application...

CVE-2022-1721 Path Traversal in WellKnownServlet in jgraph/drawio

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application...

CVE-2022-1722

CVE-2022-1722 describes an SSRF issue in the editor’s proxy of JGraph Draw.io (jgraph/drawio) prior to version 18.0.5. The vulnerability arises from failing to filter IPv6 link-local addresses, allowing SSRF requests to internal link-local IPv6 addresses (fe80::/10). Affected component is the edi...

CVE-2022-1722 SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio

SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses...

CVE-2022-1722 SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio

SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses...

PT-2022-14065 · Jgraph · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 18.0.4 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability on the /proxy endpoint in the jgraph/drawio GitHub repository. This allows an attacker to make a request as the serve...

CVE-2022-1575

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary remote code execution in the desktop app. - Stored XSS in the web app...

CVE-2022-1575

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary remote code execution in the desktop app. - Stored XSS in the web app...

CVE-2022-1575

CVE-2022-1575 affects JGraph Draw.io (jgraph/drawio) including the desktop and web apps, due to a sanitizer bypass in the core library. The underlying issue is a mutation XSS in the sanitizer (Graph.sanitizeHtml), enabling arbitrary code execution in the desktop app and stored XSS in the web app....

Arbitrary Code Execution through Sanitizer Bypass

Description The sanitizer function of the drawio core library which is responsible to sanitize various parts of a diagram of potentially dangerous HTML/JavaScript code can be bypassed. It is vulnerable to mutation XSS payloads, which allows escaping from the sanitizer. This allows arbitrary code...