CVE-2015-2298

Опубликовано: 12 янв. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.

Ссылки

http://www.openwall.com/lists/oss-security/2015/03/15/3
Issue Tracking
Mailing List
Third Party Advisory
https://github.com/ether/etherpad-lite/commit/a0fb65205c7d7ff95f00eb9fd88e93b300f30c3d
Patch
https://github.com/ether/etherpad-lite/releases/tag/1.5.2
Patch
Release Notes
http://www.openwall.com/lists/oss-security/2015/03/15/3
Issue Tracking
Mailing List
Third Party Advisory
https://github.com/ether/etherpad-lite/commit/a0fb65205c7d7ff95f00eb9fd88e93b300f30c3d
Patch
https://github.com/ether/etherpad-lite/releases/tag/1.5.2
Patch
Release Notes

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:etherpad:etherpad:1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:etherpad:etherpad:1.5.0:d:*:*:*:*:*:*

cpe:2.3:a:etherpad:etherpad:1.5.1:*:*:*:*:*:*:*

EPSS

Процентиль: 39%

0.00171

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2015-2298

CVSS3: 7.5

debian

около 8 лет назад

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allo ...

GHSA-v3j9-639r-vw5x

CVSS3: 7.5

github

больше 3 лет назад

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.

EPSS

Процентиль: 39%

0.00171

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200