TI-2021-19608 CVE-2021-43802
Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports
Priority MEDIUM 46
Etherpad is a real-time collaborative editor.
Etherpad
Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
Etherpad records in CISA KEVNo Etherpad vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
16 records in Etherpad · all components
TI-2018-06747 CVE-2018-9326 · GHSA-m23v-c4gr-rh56
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.
Priority MEDIUM 46
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.
TI-2018-04991 CVE-2018-6835 · GHSA-mvmv-rq2j-97p2
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which…
Priority MEDIUM 46
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
TI-2015-02917 CVE-2015-3297 · GHSA-487r-wq2j-f8m4
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2…
Priority MEDIUM 41
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTT…
TI-2018-06748 CVE-2018-9327 · GHSA-rhc8-hggx-ccrf
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the…
Priority LOW 38
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server.
TI-2015-03442 CVE-2015-4085 · GHSA-5m5m-h2hf-vfh9
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Priority LOW 37
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
TI-2015-02926 CVE-2015-3309 · GHSA-fpgg-qjcj-58g7
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4…
Priority LOW 37
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a ..
TI-2015-02031 CVE-2015-2298 · GHSA-v3j9-639r-vw5x
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers…
Priority LOW 37
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
TI-2021-13810 CVE-2021-34816 · GHSA-4w5m-3w7v-8phf
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged…
Priority LOW 36
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source.
TI-2020-14396 CVE-2020-22785 · GHSA-7wwq-q495-rfg3
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of…
Priority LOW 35
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service.
TI-2020-14393 CVE-2020-22782 · GHSA-4gqv-xjf8-34q6
Etherpad < 1.8.3 is affected by a denial of service in the import functionality.
Priority LOW 35
Etherpad < 1.8.3 is affected by a denial of service in the import functionality.
TI-2020-14392 CVE-2020-22781 · GHSA-66mc-4v3r-qwh3
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the…
Priority LOW 35
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).
TI-2018-06746 CVE-2018-9325 · GHSA-ffh9-gmph-h864
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads…
Priority LOW 35
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.
TI-2021-13811 CVE-2021-34817 · GHSA-543c-wff7-pg59
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote…
Priority LOW 30
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
TI-2020-14394 CVE-2020-22783 · GHSA-fpgr-p888-f8j7
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log…
Priority LOW 30
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files.
TI-2019-13228 CVE-2019-18209 · GHSA-wm6p-54cv-qxf5
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the…
Priority LOW 28
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.