CRITICAL9.8

GHSA-mvmv-rq2j-97p2

Etherpad Lite Access Restriction Bypass

Quick fix

GHSA-mvmv-rq2j-97p2 — ep_etherpad-lite: upgrade to the fixed version with the command below.

npm install ep_etherpad-lite@1.6.3

Details

`node/hooks/express/apicalls.js` in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/ep_etherpad-lite

Introduced in: 0Fixed in: 1.6.3

Fixnpm install ep_etherpad-lite@1.6.3

References

https://nvd.nist.gov/vuln/detail/CVE-2018-6835[ADVISORY]
https://github.com/ether/etherpad-lite/commit/626e58cc5af1db3691b41fca7b06c28ea43141b1[WEB]
https://github.com/ether/etherpad-lite[PACKAGE]
https://github.com/ether/etherpad-lite/releases/tag/1.6.3[WEB]