What is GHSA-cm22-88qr-7ffh?

GHSA-cm22-88qr-7ffh is a security advisory published by GitHub Security Advisories with High severity. Lavalite vulnerable to Arbitrary File Read via Directory Traversal

Which CVE IDs does GHSA-cm22-88qr-7ffh cover?

GHSA-cm22-88qr-7ffh covers the following CVE IDs: CVE-2022-42188. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cm22-88qr-7ffh?

GHSA-cm22-88qr-7ffh has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-cm22-88qr-7ffh?

GHSA-cm22-88qr-7ffh affects 1 product, including: composer/lavalite/cms:= 9.0.0.

GHSA-cm22-88qr-7ffhHighCVSS 7.5

Lavalite vulnerable to Arbitrary File Read via Directory Traversal

Vendor

GitHub Security Advisories

Published

October 19, 2022

Last Modified

July 7, 2023

🔗 CVE IDs covered (1)

CVE-2022-42188 →

📋 Description

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

🎯 Affected products1

composer/lavalite/cms:= 9.0.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-42188
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite
https://github.com/advisories/GHSA-cm22-88qr-7ffh