VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jun 19, 2018· Updated Jun 17, 2026

CVE-2018-12563

CVE-2018-12563

Description

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.

Affected products

3
  • Linaro/Lavainferred3 versions
    <2018.5.post1+ 2 more
    • (no CPE)range: <2018.5.post1
    • cpe:2.3:a:linaro:lava:*:*:*:*:*:*:*:*range: <2018.5.post1
    • (no CPE)range: < 2018.5.post1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.