CVE-2022-0672

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	LemMinX	LemMinX versions prior to 0.19.0

References

https://github.com/eclipse/lemminx/blob/master/CHANGELOG.md#0190-february-14-2022Release Notes, Third Party Advisory
https://github.com/eclipse/lemminx/blob/master/CHANGELOG.md#0190-february-14-2022Release Notes, Third Party Advisory

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06736.5A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.CVE-2022-06744.8The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as CVE-2022-06759.8In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in CVE-2022-06767.8Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-06777.5Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in CVE-2022-06786.1Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06799.8The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call CVE-2022-06806.1The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable op CVE-2022-06816.5The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attacker CVE-2022-06836.1The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization CVE-2022-06844.8The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to CVE-2022-06857.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.