CVE-2018-6835 Etherpad Lite Access Restriction Bypass
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm ep_etherpad-lite(npm) | < 1.6.3 | 1.6.3 |
| etherpad | < 1.6.3 | 1.6.3 |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com release-notes third-party-advisory
- github.com