CVE-2018-9327: Input Validation
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Etherpad instance to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
Etherpad document database backend = DirtyDB, CouchDB, MongoDB, or RethinkDB
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9327?
CVE-2018-9327 is classified as a critical vulnerability due to the potential for arbitrary code execution on affected Etherpad servers.
How do I fix CVE-2018-9327?
To fix CVE-2018-9327, upgrade to Etherpad version 1.6.4 or later as it addresses the vulnerability.
Which versions of Etherpad are affected by CVE-2018-9327?
CVE-2018-9327 affects Etherpad versions 1.5.0 through 1.5.7 and versions 1.6.0 through 1.6.3.
What conditions must be met for CVE-2018-9327 to be exploited?
For CVE-2018-9327 to be exploited, the Etherpad instance must be configured to use a document database such as DirtyDB, CouchDB, MongoDB, or RethinkDB.
What are the implications of CVE-2018-9327 for my Etherpad instance?
The implications of CVE-2018-9327 include unauthorized execution of arbitrary code, which can compromise the integrity and security of your Etherpad instance.