VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jun 19, 2018· Updated Jun 17, 2026

CVE-2018-12563

CVE-2018-12563

Description

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.

Affected products

2
  • Linaro/Lavainferred2 versions
    <2018.5.post1+ 1 more
    • (no CPE)range: <2018.5.post1
    • (no CPE)range: < 2018.5.post1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.