CVE-2015-3309: Path Traversal
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3309?
CVE-2015-3309 has a moderate severity due to its potential to allow unauthorized file access.
How do I fix CVE-2015-3309?
To fix CVE-2015-3309, upgrade Etherpad to version 1.5.5 or later, which addresses this directory traversal vulnerability.
What versions of Etherpad are affected by CVE-2015-3309?
CVE-2015-3309 affects Etherpad versions 1.1.2 through 1.5.4.
What type of vulnerability is CVE-2015-3309?
CVE-2015-3309 is a directory traversal vulnerability that allows attackers to read arbitrary files.
Who can exploit CVE-2015-3309?
CVE-2015-3309 can be exploited by remote attackers who can craft HTTP API requests with a malformed path parameter.