CVE catalog

CVE-2023-3432

plantuml: CVE-2023-3432

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.87% · Oct 27, 2026

Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianplantumlsid1:1.2020.2+ds-6vulnerable
Debianplantumlforky1:1.2020.2+ds-6vulnerable
Debianplantumltrixie1:1.2020.2+ds-6vulnerable
Debianplantumlbookworm1:1.2020.2+ds-3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianplantumlsourcesid(unfixed)not yet assignedNot reported[1040000]
Debianplantumlsourceforky(unfixed)not yet assignedNot reported[1040000]
Debianplantumlsourcetrixie(unfixed)not yet assignedNot reported[1040000]
Debianplantumlsourcebookworm(unfixed)not yet assignedNot reported[1040000]

[Debian bug #1040000]

Notes

[trixie] plantuml: Minor issue [bookworm] plantuml: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [plantuml]Affected
    Details (2)

    • 1:1.2020.2+ds-3 · all · bookworm

      Affected

      dsa · plantuml · debian · bookworm; dsa · plantuml · debian · 12

    • 1:1.2020.2+ds-3 · all · bookworm

      Affected

      dsa · plantuml · debian · bookworm; dsa · plantuml · debian · 12

[Debian 13 (Trixie)]

  • [plantuml]Affected
    Details (2)

    • 1:1.2020.2+ds-6 · all · trixie

      Affected

      dsa · plantuml · debian · 13

    • 1:1.2020.2+ds-6 · all · trixie

      Affected

      dsa · plantuml · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]