Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2022-1723: Draw.io Server Can Be Tricked into Making Unauthorized Requests
CVE-2022-1723 · published 4 years ago
Summary
Draw.io, a diagramming tool, is affected by a security issue that allows an attacker to trick the server into making unauthorized requests. This could potentially allow an attacker to access sensitive information or disrupt the server's functionality. To protect against this issue, update Draw.io to version 18.0.6 or later.
What to do
- Update diagrams drawio to version 18.0.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| diagrams | drawio |
< 18.0.6 cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:* |
Original advisory text
Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1723.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-1723 Vendor Advisory
- https://huntr.dev/bounties/619851a4-2a08-4196-80e9-ab41953491d8 URL
- https://github.com/jgraph/drawio/commit/7a68ebe22a64fe722704e9c4527791209fee2034 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published17 May 2022
Updated3 Nov 2026
First seen4 Aug 2026
Track software like this
Free during beta