CVE-2022-42188

Description

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

Affected Platforms

Weakness Type

CWE-22, CWE-22

References

• https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite
• https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite