PT-2019-15277 · Etherpad · Etherpad Lite

Published 2019-10-19 · Updated 2019-10-22 · CVE-2019-18209

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Etherpad-Lite version 1.7.5

Description The issue arises in the templates/pad.html file of Etherpad-Lite when the browser does not properly encode the path of the URL, leading to a cross-site scripting (XSS) vulnerability. This has been demonstrated using Internet Explorer.

Recommendations For Etherpad-Lite version 1.7.5, consider updating to a newer version that addresses this issue, as using a browser that properly encodes URLs may mitigate the risk, but does not resolve the underlying problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-18209

Affected Products

Etherpad Lite

References · 3

• https://github.com/ether/etherpad-lite/commit/5879037ddca4ab9a4002adf90fc7ce6c9f82f01b · Patch
• https://osv.dev/vulnerability/CVE-2019-18209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18209 · Security Note