Multiple vulnerabilities in Etherpad

Published: 2018-04-07 | Updated: 2020-07-17

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-9325 CVE-2018-9327
CWE-ID	CWE-200 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Etherpad Web applications / CMS
Vendor	The Etherpad Foundation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU31331

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-9325

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Etherpad: 1.6.0 - 1.6.3

CPE2.3

External links

http://blog.etherpad.org/2018/04/07/important-release-1-6-4/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU31332

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-9327

CWE-ID: CWE-20 - Improper input validation