CVE-2022-0673: Path Traversal in LemMinX
Summary
CVE-2022-0673: Path Traversal in LemMinX. Affects org.eclipse.lemminx:lemminx-parent versions < 0.19.0. Fixed in 0.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LemMinX is a Maven package in the Eclipse ecosystem. It provides functionality for parsing and validating XML documents. The package is widely used for XML processing in various applications. However, versions prior to 0.19.0 are vulnerable to a path traversal attack. This vulnerability allows an attacker to poison the cache of external schema files by exploiting a directory traversal flaw.
Vulnerability Detail
The path traversal vulnerability in LemMinX allows an attacker to access files outside the intended directory. By manipulating input parameters, an attacker can traverse the file system and potentially access sensitive files. In the context of LemMinX, this vulnerability enables cache poisoning of external schema files, which can lead to various security issues and data integrity problems.
How To Fix
Minimum fixed version
0.19.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The path traversal vulnerability in LemMinX can be mitigated by updating to version 0.19.0 or later. It is crucial to promptly apply the fix to prevent potential security issues and data integrity problems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.lemminx:lemminx-parent →
FAQ
LemMinX is a Maven package in the Eclipse ecosystem that provides functionality for parsing and validating XML documents.
The vulnerability allows an attacker to poison the cache of external schema files, which can lead to security issues and data integrity problems.
To fix this vulnerability, update to version 0.19.0 or later of the LemMinX package.
There are no known workarounds. Updating to the fixed version is the recommended solution.
For more information, you can visit the vulnerability advisory page at Vulert Scanner
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.lemminx:lemminx-parent.
