PT-2024-34563 · Firepad · Firepad

Published 2024-12-04 · Updated 2024-12-05 · CVE-2024-51210

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firepad versions 1.5.11 and earlier

Description The issue allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. This behavior is intentional in several similar products for anyone who knows the full document ID and corresponding URL. However, this vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For Firepad versions 1.5.11 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Information Disclosure

Weakness Enumeration

CWE-125

CWE-200

Related Identifiers

CVE-2024-51210

GHSA-4FH7-M2WX-6WFM

Affected Products

Firepad

References · 10

• https://osv.dev/vulnerability/CVE-2024-51210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51210 · Security Note
• https://osv.dev/vulnerability/GHSA-4fh7-m2wx-6wfm · Vendor Advisory
• https://github.com/FirebaseExtended/firepad/releases/tag/v1.5.11 · Note
• https://github.com/FirebaseExtended/firepad · Note
• https://t.me/cvedetector/12035 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1864430023131722103 · Twitter Post
• https://medium.com/@adityaahuja.work/accessing-full-history-of-firepad-users-ddc889e73936 · Note
• https://twitter.com/CVEnew/status/1864417971939971252 · Twitter Post
• https://firebase.blog/posts/2013/04/announcing-firepad-our-open-source · Note