Description
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Recommendation
Update the ep_etherpad-lite package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.6.3
- Patched version(s): 1.6.3
References
Could your website be exposed too?
SmartScanner can check your website for Etherpad Lite Access Restriction Bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
- ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartex - CVE-2026-55088
- ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink- - CVE-2026-55086
- File restriction bypass in socket.io-file - CVE-2020-24807
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2023