CVE-2018-6835: Input Validation
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Other sources
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ep_etherpad-liteto a version that resolves this vulnerability.Fixed in 1.6.3 - Upgrade
Upgrade
Etherpad Liteto a version that resolves this vulnerability.Fixed in 1.6.3 - Compensating control
Verify any access restrictions that were intended to be enforced via JSONP handling in node/hooks/express/apicalls.js are still correctly applied after upgrading to v1.6.3.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6835?
The severity of CVE-2018-6835 is classified as high due to its potential to allow unauthorized access.
How do I fix CVE-2018-6835?
To fix CVE-2018-6835, upgrade Etherpad Lite to version 1.6.3 or later.
What software is affected by CVE-2018-6835?
CVE-2018-6835 affects Etherpad Lite versions prior to 1.6.3.
Can CVE-2018-6835 be exploited remotely?
Yes, CVE-2018-6835 can be exploited remotely by attackers due to improper handling of JSONP.
What does CVE-2018-6835 allow attackers to do?
CVE-2018-6835 allows attackers to bypass intended access restrictions.