CVE-2018-9327 Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB)...
HighCVSS 8.1
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| etherpad | >= 1.5.0, <= 1.5.7 | No fix listed |
| etherpad | >= 1.6.0, < 1.6.4 | 1.6.4 |
References
- blog.etherpad.org vendor-advisory