PT-2022-13347 · Lemminx · Lemminx

Published 2022-02-18 · Updated 2022-02-26 · CVE-2022-0673

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LemMinX versions prior to 0.19.0

Description A flaw in LemMinX allows cache poisoning of external schema files due to directory traversal. This issue enables potential exploitation by manipulating external schema files.

Recommendations For versions prior to 0.19.0, update to version 0.19.0 or later to resolve the issue. As a temporary workaround, consider restricting access to external schema files to minimize the risk of cache poisoning.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-0673

GHSA-GGGP-GH2P-996X

Affected Products

Lemminx

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-0673 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0673 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gggp-gh2p-996x · Vendor Advisory
• https://github.com/eclipse/lemminx/blob/master/CHANGELOG.md#0190-february-14-2022 · Note
• https://github.com/eclipse/lemminx/pull/1171 · Note
• https://github.com/eclipse/lemminx · Note