Paper/Archive/CVE-2022-2014

CVE-2022-2014

jgraph jgraph/drawio — Code Injection in jgraph/drawio

EPSS 0.7%CVSS 9.6

critical.is priorityof 100

40

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 54.8.548 × 2011.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.

Affected

ProductAffectedFixed inSource

jgraph/drawiounspecified – < 19.0.219.0.2CNA

Scores by source

@huntrdev (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References

refhuntr.dev/bounties/911a4ada-7fd6-467a-a464-b88604b16ffc refgithub.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825