Unscored CVE-2015-3297 EUVD-2015-3343GHSA-487r-wq2j-f8m4

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files b…

Published Jul 7, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Description

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.

References

[oss-security] 20150410 Re: CVE Request for read-only directory traversal in Etherpad Minify mailing-list
74056 vdb-entry
https://github.com/ether/etherpad-lite/commit/9d4e5f6
[oss-security] 20150412 Corrections to CVE-2015-3297 mailing-list