Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Linaro LAVA 安全漏洞
Vulnerability Description
Linaro LAVA是一套自动化验证系统。该系统主要用于测试基于ARM内核的设备系统的部署情况。 Linaro LAVA 2018.5.post1之前版本中存在安全漏洞，该漏洞源于程序支持file: URLs。攻击者可利用该漏洞强制lava-server-gunicorn下载文件系统上的任意文件。
CVSS Information
N/A
Vulnerability Type
N/A