PT-2022-13974 · Drawio · Drawio

Published 2022-05-05 · Updated 2022-05-12 · CVE-2022-1575

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions drawio versions prior to 18.0.0

Description The issue concerns arbitrary code execution through sanitizer bypass in the desktop app and stored XSS in the web app. This allows for remote code execution.

Recommendations For versions prior to 18.0.0, update to version 18.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the desktop app and web app to minimize the risk of exploitation. Avoid using the web app until the issue is resolved.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2022-1575

Affected Products

Drawio

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1575.json · Exploit
• 🔥 https://huntr.dev/bounties/033d3423-eb05-4b53-a747-1bfcba873127 · Exploit
• https://github.com/jgraph/drawio/commit/f768ed73875d5eca20110b9c1d72f2789cd1bab7 · Patch
• https://osv.dev/vulnerability/CVE-2022-1575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1575 · Security Note
• https://t.me/cvenotify/29727 · Telegram Post
• https://t.me/cibsecurity/41987 · Telegram Post
• https://t.me/cvenotify/29728 · Telegram Post