PlantUML Database Information Macro cross site scripting

Successful exploitation of CVE-2020-36523 allows an attacker to inject arbitrary JavaScript code into a PlantUML diagram rendered in a user's browser. This can lead to various malicious outcomes, including session hijacking, defacement of the PlantUML interface, and theft of sensitive information. The impact is particularly concerning in environments where PlantUML diagrams are used to display confidential data or are integrated into critical workflows. Because the vulnerability is triggered remotely, an attacker does not need local access to the PlantUML server to exploit it.

Organizations and individuals using PlantUML versions 6.43 through 6.43, particularly those who rely on PlantUML to generate diagrams from user-supplied data or integrate it into web applications, are at risk. Shared hosting environments where multiple users can potentially influence PlantUML diagrams are also particularly vulnerable.

1. 2020-00-00Discovery

   discovery

2. 2022-06-03Disclosure

   disclosure

3. 2022-06-03Patch

   patch

1. 予約済み2022-05-27
2. 公開日2022-06-03
3. 更新日2025-04-15
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2020-36523 is to upgrade PlantUML to version 6.43.1 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing input validation and sanitization on any user-supplied data used within PlantUML diagrams. While a direct WAF rule is difficult to implement without specific knowledge of the attack vectors, restricting access to the Database Information Macro functionality could reduce the attack surface. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into a PlantUML diagram and confirming that it is not executed.