PT-2022-14134 · Unknown · Jgraph/Drawio

Published 2022-05-25 · Updated 2022-06-07 · CVE-2022-1815

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jgraph/drawio versions prior to 18.1.2

Description The issue concerns exposure of sensitive information to an unauthorized actor in the GitHub repository.

Recommendations For versions prior to 18.1.2, update to version 18.1.2 or later to resolve the issue.

Exploit

Fix

Information Disclosure

SSRF

Weakness Enumeration

CWE-200

CWE-918

Related Identifiers

CVE-2022-1815

Affected Products

Jgraph/Drawio

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1815.json · Exploit
• 🔥 https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f · Exploit
• https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1815 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1815 · Vendor Advisory