#VU38721 Path traversal in Etherpad - CVE-2015-3297
Published: July 7, 2017 / Updated: December 28, 2020
Vulnerability identifier: #VU38721
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2015-3297
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Etherpad
Etherpad
Software vendor:
The Etherpad Foundation
The Etherpad Foundation
Description
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
Remediation
Install update from vendor's website.