Description
Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.5.11
References
Could your website be exposed too?
SmartScanner can check your website for Firepad allows insecure document access and gives you actionable findings to investigate.
Start a free scanRelated Issues
- AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
- happy-dom allows for server side code to be executed by a <script> tag - CVE-2024-51757
- AngularJS allows attackers to bypass common image source restrictions - angular - CVE-2024-8373
- secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
You might also like:
See something that needs correcting? Let us knowUpdated December 05, 2024