Exposure of Sensitive Information to an Unauthorized Actor in LemMinX

MEDIUM 5.5CVE-2022-0672 · GHSA-hrxv-694f-22g3 · Published 18/02/2022 · updated 17/06/2026

In short

CVE-2022-0672 is a MEDIUM (CVSS 5.5) vulnerability affecting org.eclipse.lemminx:lemminx-parent, lemminx (eclipse).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 23.1% of all vulnerabilities.
Fix: update to 0.19.0 or later.

Package	Affected versions	Patched versions
org.eclipse.lemminx:lemminx-parent Maven	`< 0.19.0`	`0.19.0`
lemminx eclipse	`< 0.19.0`	`0.19.0`

Description

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.

NVD description

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.

References

nvd.nist.gov/vuln/detail/CVE-2022-0672 · ADVISORY
eclipse/lemminx#1174 · WEB
eclipse/lemminx commit 076b880 · WEB
eclipse/lemminx · PACKAGE
eclipse/lemminx · WEB

More vulnerabilities in org.eclipse.lemminx:lemminx-parent

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.eclipse.lemminx:lemminx-parent

Maven

< 0.19.0

0.19.0

lemminx

eclipse

< 0.19.0

0.19.0

Description

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.

NVD description

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.

More vulnerabilities in org.eclipse.lemminx:lemminx-parent

See all →