CVE-2015-3297

CVE-2015-3297

EPSS 5.0%

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.

Produtos afetados

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/ether/etherpad-lite/commit/9d4e5f6 http://www.openwall.com/lists/oss-security/2015/04/11/1 http://www.openwall.com/lists/oss-security/2015/04/12/1 http://www.securityfocus.com/bid/74056