CVE-2022-42902

In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.

• CWE-94

• https://git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963be228b52?merge_request_iid=1834Patch, Vendor Advisory
• https://git.lavasoftware.org/lava/lava/-/merge_requests/1834Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00019.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5260Third Party Advisory
• https://git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963be228b52?merge_request_iid=1834Patch, Vendor Advisory
• https://git.lavasoftware.org/lava/lava/-/merge_requests/1834Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00019.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5260Third Party Advisory

Published

Oct 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42897Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allo…9.8
• CVE-2022-42898PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1…8.8
• CVE-2022-42899Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-4290The Cyr to Lat plugin for WordPress is vulnerable to authent…8.8
• CVE-2022-42900Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42901Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42903Zoho ManageEngine SupportCenter Plus through 11024 allows lo…3.3
• CVE-2022-42904Zoho ManageEngine ADManager Plus through 7151 allows authent…7.2
• CVE-2022-42905In wolfSSL before 5.5.2, if callback functions are enabled (…9.1
• CVE-2022-42906powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 a…7.8
• CVE-2022-42908WEPA Print Away is vulnerable to a stored XSS. It does not p…5.4
• CVE-2022-42909WEPA Print Away does not verify that a user has authorizatio…5.4