CVE-2022-1767

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-1767
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-1767.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-1767
Published
2022-05-18T15:45:11Z
Modified
2025-11-28T02:34:22.750804Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Server-Side Request Forgery (SSRF) in jgraph/drawio
Details

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "@huntrdev",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1767.json"
}
References

Affected packages

Git / github.com/jgraph/drawio

Affected ranges

Type
GIT
Repo
https://github.com/jgraph/drawio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c63f3a04450f30798df47f9badbc74eb8a69fbdf

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-1767.json"

vanir_signatures

[
    {
        "digest": {
            "function_hash": "186884812683017373630004054723428143378",
            "length": 3159.0
        },
        "id": "CVE-2022-1767-17f991df",
        "signature_type": "Function",
        "source": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf",
        "target": {
            "function": "doGet",
            "file": "src/main/java/com/mxgraph/online/ProxyServlet.java"
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "digest": {
            "line_hashes": [
                "330892302030655698734307909451534296073",
                "26422580255228963572381358905613341314",
                "158474719409455321617843442366614842240",
                "335213340414905492462493587819397223008",
                "167311714625209082827020130966106600784",
                "80484294069199290550285343010962995282",
                "314156093220996888364492614635500084845",
                "326933780360228613128055879087335629622",
                "303542250235936158307734341585968630816",
                "261949288075248307560000981405633582934",
                "157910352479487713035021565754734900270",
                "211248280624844732961347831849338097949",
                "4363142957084156599226324708793307738",
                "202427524478803985736316936370121814694",
                "241232588063987205678852167376852769669",
                "125961764828958048890461158296237509491",
                "135045042276514809325548791757540776392",
                "86217562644788289746845550039189821419",
                "59607150229098365468236852322636456784",
                "193617576931455028468849280361622508025",
                "29568477862191871131698087003004755708",
                "9593631052799138300544845965034943896",
                "294266480416195658042312005289453459581",
                "296336922310203616576517238820575619412",
                "36915495881430849848810178312461998822",
                "209348561378359213062830996803774483314",
                "240907982672518365233287562161628627697",
                "101545239535275796651075191791646202142",
                "297032581973329239120944392021468968455",
                "47130168317094649225312521147531964429"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-1767-1b6e0ebd",
        "signature_type": "Line",
        "source": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf",
        "target": {
            "file": "src/main/java/com/mxgraph/online/ProxyServlet.java"
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "digest": {
            "line_hashes": [
                "32011423035349666097510197413558946531",
                "109846116817806095433182038249687544734",
                "107787256602508023747728129589832826553",
                "134963694081150163013105678543482086522"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-1767-1b8577f0",
        "signature_type": "Line",
        "source": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf",
        "target": {
            "file": "src/main/java/com/mxgraph/online/Utils.java"
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "222400589420210531666971790441939783801",
            "length": 923.0
        },
        "id": "CVE-2022-1767-c0455fd9",
        "signature_type": "Function",
        "source": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf",
        "target": {
            "function": "getCorsDomain",
            "file": "src/main/java/com/mxgraph/online/ProxyServlet.java"
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "digest": {
            "line_hashes": [
                "89562998154074575919832199609770825444",
                "190373042659543021460975163316072715580",
                "13589163767115081332195556137402820114",
                "217643628114449917580286912145093585171",
                "270771480290722978301934952725663742889",
                "274201533028806689225364414630797377130",
                "173563058869886143721074845149424031735",
                "116544216637479500252885430788002685865",
                "38597875430355345371097793781030990753",
                "87579589187252150223152597732496408298",
                "337877041805528386970322669093152940952",
                "283814116276042082160999205658791452984",
                "184139823380676217167117167280536879653",
                "127913403563919743684545905327523687406",
                "145699870946410701156500174322763660315"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-1767-de06678f",
        "signature_type": "Line",
        "source": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf",
        "target": {
            "file": "src/main/java/com/mxgraph/online/AbsAuthServlet.java"
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "310772960291562939023096934882959674345",
            "length": 273.0
        },
        "id": "CVE-2022-1767-e47fee73",
        "signature_type": "Function",
        "source": "https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf",
        "target": {
            "function": "isAbsolute",
            "file": "src/main/java/com/mxgraph/online/AbsAuthServlet.java"
        },
        "deprecated": false,
        "signature_version": "v1"
    }
]