{"id":"CVE-2023-3431","summary":"Improper Access Control in plantuml/plantuml","details":"Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.","aliases":["GHSA-p2mf-q26j-3xmh"],"modified":"2026-08-12T13:34:29.364115Z","published":"2023-06-27T14:28:33.739Z","database_specific":{"cna_assigner":"@huntrdev","cwe_ids":["CWE-284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3431.json"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/fa741f95-b53c-4ed7-b157-e32c5145164c"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3431.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3431"},{"type":"FIX","url":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/plantuml/plantuml","events":[{"introduced":"0"},{"fixed":"74574c4f57d8d56b0e740b64e3d005ed071b2da2"},{"fixed":"fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e"}],"database_specific":{"cpe":"cpe:2.3:a:plantuml:plantuml:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.2023.9"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.2023.8","v1.2023.7","v1.2023.6","v1.2023.5","v1.2023.4","v1.2023.3","v1.2023.2","v1.2023.1","v1.2023.0","v1.2022.14","v1.2022.13","v1.2022.12","v1.2022.11","v1.2022.10","v1.2022.9","v1.2022.8","v1.2022.7","v1.2022.6","v1.2022.5","v1.2022.4","v1.2022.3","v1.2022.2","v1.2022.1","v1.2022.0","v1.2021.16","v1.2021.15","v1.2021.14","v1.2021.13","v1.2021.12","v1.2021.10","v1.2021.9","v1.2021.8","v1.2021.7","v1.2021.6","v1.2021.5","v1.2021.4","v1.2021.3","v1.2021.2","v1.2021.1","v1.2021.0","v1.2020.26","v1.2020.24","v1.2020.23","v1.2020.22","v1.2020.21","v1.2020.20","v1.2020.19","v1.2020.18","v1.2020.17","v1.2020.16","v1.2020.15","v1.2020.14","v1.2020.13","v1.2020.12","v1.2020.11","v1.2020.10","v1.2020.9","v1.2020.8","v1.2020.7","v1.2020.6","v1.2020.4","v1.2020.3","v1.2020.2","v1.2020.1","v1.2020.0","v1.2019.13","v1.2019.12","v1.2019.11","v1.2019.10","v1.2019.9","v1.2019.8","v1.2019.7","v1.2019.6","v1.2019.5","v1.2019.4","v1.2019.2","v1.2019.1","v1.2019.0","v1.2018.14","v1.2018.13","v1.2018.12","v1.2018.11","v1.2018.10","v1.2018.9","v1.2018.8","v1.2018.7","v1.2018.6","v1.2018.5","v1.2018.4","v1.2018.3","v1.2018.2","v1.2018.1","v1.2018.0","v1.2017.20","v1.2017.19","v1.2017.18","v1.2017.17","v1.2017.15","v1.2017.14","v1.2017.13","v1.2017.12","v2017.11","v2017.09","v2017.08","v8059"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3431.json","vanir_signatures_modified":"2026-08-12T13:34:29Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/preproc/ImportedFiles.java","function":"isAllowed"},"deprecated":false,"digest":{"function_hash":"295671681575716211859674241965946186000","length":236},"id":"CVE-2023-3431-03ce3777"},{"target":{"function":"getAFile","file":"src/net/sourceforge/plantuml/preproc/ImportedFiles.java"},"deprecated":false,"digest":{"length":690,"function_hash":"138628822802626236979227039996092801179"},"id":"CVE-2023-3431-1317f43a","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e"},{"signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/security/SecurityUtils.java"},"deprecated":false,"digest":{"line_hashes":["70707241394405025232645611292324547059","33184566281828019193828520470734606135","330816893024893871030925531994571319863","123222711058072444801259751711702577633","169216569462703701377612689403887150710","164296879805937023173477345758877875489"],"threshold":0.9},"id":"CVE-2023-3431-1d3e1e32","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["210515168564025757901942452174593943749","42647438058321653966432471086781283291","299904126988688993460797719245296501832","49565929308389227729446955991442276313","300144468707324780803554984547832280147"],"threshold":0.9},"id":"CVE-2023-3431-2b96d4c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/version/LicenseInfo.java"}},{"signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java"},"deprecated":false,"digest":{"line_hashes":["256324481792485760998147825627873189046","56670958834994939275063077501557678368","219476885066342344978352977205319928725","154477007438697345736117732853958923194","91728285534948167562085535601275237730","55751362714565935488529242582043814312","71561401465696932291825548434158969335","119339270261288956678926877825755755296","43944486058659702562709498546605711598","37726833807991586763368742142935277593"],"threshold":0.9},"id":"CVE-2023-3431-369ca7e1","signature_type":"Line"},{"id":"CVE-2023-3431-3afcd3f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/security/SFile.java"},"deprecated":false,"digest":{"line_hashes":["207701546150694293457764529566779027295","49998310382257502309661894804057749292","20851392022704228181869660779157628851","61428248874584237710679155953971327601","72491200449950197554336271922686797630","1302932659165008021984175783386694081","59493212917515536409049326213577935145","294332292924590892416795118073067109472","282696667324840721204512968210578349555","22005330921324990935255213380539087483"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/FileExists.java","function":"executeReturnFunction"},"deprecated":false,"digest":{"function_hash":"140381737713758724605074770456806974462","length":321},"id":"CVE-2023-3431-3f3c6473"},{"id":"CVE-2023-3431-414cbfc4","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/Getenv.java"},"deprecated":false,"digest":{"line_hashes":["82593515397456814300391935582543520124","313415320249935561359134811076297426228","336089327203033597315652734706478387688","265208622713820745245680475319345505020","20440202004088442185537029183168373737","319056913707537841550743455411537274762","317025510414475158580729168947528632641","36752952804877926969540623272616707617","144520977893402479958342481011896218944","299874491427917706642685036803308437662","235083652034081260396488619040881188604","161565944219854835206668842481557221699","28160429125185869293644279760745859370","60332093068620864210802371266731648937","2350722975721544610355528506150369035","214011167471722682788498676846667002945","325411890094493482094935932493359103563","209655304996599417207222385990335161059"],"threshold":0.9}},{"digest":{"line_hashes":["256661365122838826541229538519975137226","269182912484056040645781467191056859478","334380381096962201455575632387985494433","321237904051611807903460296685104223679","339091294525818687170787306364855532068","173312891188850722156529215430359715531","133009306440247803659936845538869081182"],"threshold":0.9},"id":"CVE-2023-3431-4567675e","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/OptionFlags.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"132902297885041549482302335456219754968","length":889},"id":"CVE-2023-3431-532cfcd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/LoadJson.java","function":"loadStringData"}},{"id":"CVE-2023-3431-543e957e","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/preproc/ImportedFiles.java","function":"getFile"},"deprecated":false,"digest":{"function_hash":"232988119417391698118153901512236415946","length":418}},{"target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/FileExists.java","function":"fileExists"},"deprecated":false,"digest":{"function_hash":"298270292869139346311858303540944568845","length":102},"id":"CVE-2023-3431-6d3e9182","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e"},{"id":"CVE-2023-3431-7a8313e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/FileExists.java"},"deprecated":false,"digest":{"line_hashes":["82593515397456814300391935582543520124","259071242154017647817266854090332040831","102907114775737697299545405613640593236","256288078075804964226751176419569512436","20440202004088442185537029183168373737","16025080765642744650800131214978971634","332984626192607288916267510945251842187","64037390207966777852281179541626316459","236706024146421916098827135588526484031","263610246405184061900057008755593491295","254304674096324767724913406458884932549","111360325776344402221566404809680150037","300705604461297422664375869975930930724","166663623295691456667291761128086881179"],"threshold":0.9}},{"source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/preproc/ImportedFiles.java"},"deprecated":false,"digest":{"line_hashes":["56949855484150835526612283684283291174","265392703532280520950264384671054040806","6803911083789494355353244297916585757","327469427453145885280404479856877502844","244902243605055210223401873028024132199","279951063791932336170053476838804510128","29388838813876182059337822229462940638","187819651984175543791182808951285148521","295959386967973516174945480457435087832","159349555200058470202806094528970847911","108240105133723627099060709658939598924","127782862217254761269936934668076971494","59052435771900421166625907570357164307","276309807914591996745129672896645271503","169065640376995106552565359336806591695","18321886824673264660496606007064193042","12368409499950536014244685444513064683","300494571825683785108002603307203727235","276879104745036673049884269798260459858","113464502699799428400251939486541662673","33812934817492734255422475051078328923","131244216260185356245174468049987455949","221839162269801483932316022497096549976","57300733303693924943034773470830469561","329524587727411810043077594362659370560","280434648638475190715350236724113811433","47057960724269376676228255578960603791","41666661399088622198356775952724313475","225368559426216035357218852858830102477","202256101183492912784465210192016089907","243983355331013546633973380607093987514","28123310583431867020681111686092985307","177084753405953219210419930347919217638","231579835506902227128991393413389935150","39024790900162186604499432487950608000","113947080962230820824868449430164825177","196628377364554255280769565920165561577","276495015671494883802000744508442132315","212135929589335220487538839289495845660","335368997064465428931056375056340718651","114007619688918933356691788873886209432","273463136551954460076211149584112224343","109416286277006706283624019440632264218","255816151399732581934478869438162816683","158455586583586267483278495823598955306","119258988697698457769296765622298402469","183325986263730029783145769233746546977"],"threshold":0.9},"id":"CVE-2023-3431-864f524f","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/version/LicenseInfo.java","function":"retrieveNamedSlow"},"deprecated":false,"digest":{"function_hash":"207812479234444210551312523707171617433","length":599},"id":"CVE-2023-3431-90b1556d","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/net/sourceforge/plantuml/security/SURL.java"},"deprecated":false,"digest":{"line_hashes":["115567330883225380095908451708534079799","58586099198746526428922845814069807432","10224432396185652366955444417416007964","253069242297305364447713446666003222049"],"threshold":0.9},"id":"CVE-2023-3431-974623cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e"},{"deprecated":false,"digest":{"function_hash":"227436296115628258863052872776064856333","length":207},"id":"CVE-2023-3431-ab65cf85","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/Getenv.java","function":"getenv"}},{"deprecated":false,"digest":{"function_hash":"229355450937196715787033816876086413210","length":102},"id":"CVE-2023-3431-af8069c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/security/SFile.java","function":"fromFile"}},{"source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/version/PSystemVersion.java"},"deprecated":false,"digest":{"line_hashes":["14934490649173339046758351618916252057","225017555877350499898537590575365893894","92320211777360893020139242437988741148","175469732990037397488314804882350027082","299581856334850311314440181812613330775","190152119231407986887396244796169323045"],"threshold":0.9},"id":"CVE-2023-3431-cf801746","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/net/sourceforge/plantuml/OptionFlags.java","function":"setAllowIncludeFalse"},"deprecated":false,"digest":{"function_hash":"10943004671823213165319022274164867147","length":46},"id":"CVE-2023-3431-d34ecdda","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e"},{"deprecated":false,"digest":{"length":394,"function_hash":"250027776545232403304145555823018668682"},"id":"CVE-2023-3431-d809f24c","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/tim/stdlib/Getenv.java","function":"executeReturnFunction"}},{"signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/version/Version.java"},"deprecated":false,"digest":{"line_hashes":["281324789247698788548279453367432578435","94002024686682539203048910157257185379","98755750175637519147830449997773954952","207058946847568256688335705263149081387"],"threshold":0.9},"id":"CVE-2023-3431-dd132dab","signature_type":"Line"},{"id":"CVE-2023-3431-df94a6f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"function":"withCurrentDir","file":"src/net/sourceforge/plantuml/preproc/ImportedFiles.java"},"deprecated":false,"digest":{"function_hash":"318761476468489491630251270923689490079","length":113}},{"deprecated":false,"digest":{"line_hashes":["306569140673987385794977228684192182619","270611022736580468435939800776465817327","58501737963627570515060834958563219769"],"threshold":0.9},"id":"CVE-2023-3431-e8bae942","signature_type":"Line","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/security/SecurityProfile.java"}},{"source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/version/PSystemVersion.java","function":"createShowVersion2"},"deprecated":false,"digest":{"function_hash":"8012712777885011920703251645706405268","length":1073},"id":"CVE-2023-3431-eb537283","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"246687984861559636101252976924831127487","length":117},"id":"CVE-2023-3431-fd783e89","signature_type":"Function","signature_version":"v1","source":"https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e","target":{"file":"src/net/sourceforge/plantuml/security/SecurityUtils.java","function":"isSecurityEnv"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}