// For flags

CVE-2022-45132

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.

En Linaro Automated Validation Architecture (LAVA) anterior a 2022.11.1, la ejecución remota de código se puede lograr a través de la plantilla Jinja2 enviada por el usuario. El endpoint de la API REST para validar archivos de configuración de dispositivos en el servidor lava carga la entrada como una plantilla Jinja2 de una manera que puede usarse para activar la ejecución remota de código en el servidor LAVA.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-11-10 CVE Reserved
  • 2022-11-18 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-11-02 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linaro
Search vendor "Linaro"
 Lava
Search vendor "Linaro" for product "Lava"
 < 2022.11.1
Search vendor "Linaro" for product "Lava" and version " < 2022.11.1"
-
Affected