CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
30.9%
net.sourceforge.plantuml:* is vulnerable to Information Disclosure. A remote unauthenticated attacker is able to gain access to read local JSON
files, and confirm existence of those via a local file read through %load_json
, when ALLOW_PLANTUML_INCLUDE
is set to false
, resulting in disclosure of sensitive information.
github.com/advisories/GHSA-p2mf-q26j-3xmh
github.com/plantuml/plantuml-server/issues/232
github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e
huntr.dev/bounties/fa741f95-b53c-4ed7-b157-e32c5145164c
huntr.dev/bounties/fa741f95-b53c-4ed7-b157-e32c5145164c/
lists.fedoraproject.org/archives/list/[email protected]/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/