high7.5
CVE-2022-42188
Lavalite vulnerable to Arbitrary File Read via Directory Traversal
Impact
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | lavalite/cms | = 9.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lavalite | Lavalite | Version 9.0.0 |