Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code (including system commands). To gain privileges, the attacker must be able to trigger deletion of `express-session` state or wait for old `express-session` state to be cleaned up. Core Etherpad does not delete any `express-session` state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process (such as a cron job that deletes old `sessionstorage:*` records). The problem has been fixed in version 1.8.16. If users cannot upgrade to 1.8.16 or install patches manually, several workarounds are available. Users may configure their reverse proxies to reject requests to `/p/*/import`, which will block all imports, not just `*.etherpad` imports; limit all users to read-only access; and/or prevent the reuse of `express_sid` cookie values that refer to deleted express-session state. More detailed information and general mitigation strategies may be found in the GitHub Security Advisory.
Max CVSS
9.9
EPSS Score
0.13%
Published
2021-12-09
Updated
2023-08-31
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
Max CVSS
6.1
EPSS Score
0.18%
Published
2021-07-19
Updated
2021-07-27
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source.
Max CVSS
7.2
EPSS Score
0.10%
Published
2021-07-21
Updated
2021-07-30
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check.
Max CVSS
7.5
EPSS Score
0.10%
Published
2021-04-28
Updated
2021-05-05
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.
Max CVSS
6.5
EPSS Score
0.07%
Published
2021-04-28
Updated
2021-05-05
Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import endpoint would crash the instance.
Max CVSS
7.5
EPSS Score
0.10%
Published
2021-04-28
Updated
2021-05-05
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).
Max CVSS
7.5
EPSS Score
0.10%
Published
2021-04-28
Updated
2021-05-05
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
Max CVSS
6.1
EPSS Score
0.08%
Published
2019-10-19
Updated
2019-10-22
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
Max CVSS
8.1
EPSS Score
0.26%
Published
2018-04-07
Updated
2018-05-11
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.
Max CVSS
9.8
EPSS Score
0.36%
Published
2018-04-07
Updated
2018-05-11
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.
Max CVSS
7.5
EPSS Score
0.17%
Published
2018-04-07
Updated
2018-05-11
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Max CVSS
9.8
EPSS Score
0.49%
Published
2018-02-08
Updated
2019-10-03
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Max CVSS
7.5
EPSS Score
0.17%
Published
2017-09-07
Updated
2017-09-18
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
Max CVSS
7.5
EPSS Score
0.43%
Published
2020-02-13
Updated
2020-02-19
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
Max CVSS
7.5
EPSS Score
0.17%
Published
2017-07-07
Updated
2017-07-14
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
Max CVSS
7.5
EPSS Score
0.31%
Published
2018-01-12
Updated
2018-01-29
16 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!