CVE-2015-3309

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of…

published February 13, 2020

CVSS
—
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02318 · 83.2th percentile
Published
2020-02-13T19:45Z
EPSS history
Timeline
  • 13 FEB 19:45Z
    Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of…
    cvelistv5