Description

A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.

Remediation

References

https://github.com/eclipse/lemminx/blob/master/CHANGELOG.md#0190-february-14-2022

Related Vulnerabilities

CVE-2018-6464 Vulnerability in maven package org.webjars:simditor

CVE-2017-16046 Vulnerability in npm package mariadb

CVE-2022-24723 Vulnerability in npm package urijs

CVE-2018-3743 Vulnerability in npm package hekto

CVE-2022-23647 Vulnerability in npm package prismjs

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Release Notes Third Party Advisory