Description
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ep_etherpad-lite | < 1.6.3 | 1.6.3 | GHSA-mvmv-rq2j-97p2 |