CVE-2022-45132 Code injection in n/a
Remote attackers can execute arbitrary code on the LAVA server by submitting malicious Jinja2 templates via the REST API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-45132?
CVE-2022-45132 is a critical code injection vulnerability in n/a, published on 18 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
Weakness: CWE-94
Which versions are affected by CVE-2022-45132?
It affects 1 product.
Products include Linaro Lava.
How do I fix CVE-2022-45132?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-45132 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45132 exists.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2022-45132, GHSA-wjxx-hxfj-hfmh.