CVE-2015-3297: Path Traversal
Published Jul 7, 2017
·Updated
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
Affected Software
26 affected components
Etherpad Etherpad=1.1.1
Etherpad Etherpad=1.1.2
Etherpad Etherpad=1.1.3
Etherpad Etherpad=1.1.4
Etherpad Etherpad=1.1.5
Etherpad Etherpad=1.2.0
Etherpad Etherpad=1.2.1
Etherpad Etherpad=1.2.2
Etherpad Etherpad=1.2.3
Etherpad Etherpad=1.2.4
Etherpad Etherpad=1.2.5
Etherpad Etherpad=1.2.6
Etherpad Etherpad=1.2.7
Etherpad Etherpad=1.2.8
Etherpad Etherpad=1.2.9
Etherpad Etherpad=1.2.10
Etherpad Etherpad=1.2.11
Etherpad Etherpad=1.2.12
Etherpad Etherpad=1.2.81
Etherpad Etherpad=1.2.91
Etherpad Etherpad=1.3.0
Etherpad Etherpad=1.4.0
Etherpad Etherpad=1.4.1
Etherpad Etherpad=1.5.0
Etherpad Etherpad=1.5.1
Etherpad Etherpad=1.5.2
Event History
Jul 7, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3297?
CVE-2015-3297 has a medium severity level due to its directory traversal vulnerability.
2
How do I fix CVE-2015-3297?
To fix CVE-2015-3297, update to Etherpad version 1.5.3 or later where the vulnerability is patched.
3
Who is affected by CVE-2015-3297?
CVE-2015-3297 affects Etherpad versions 1.1.1 through 1.5.2.
4
What type of attacks can exploit CVE-2015-3297?
CVE-2015-3297 can be exploited by remote attackers to read arbitrary files on the server.
5
What is the cause of CVE-2015-3297?
CVE-2015-3297 is caused by improper handling of backslashes in the path parameter of HTTP API requests.