Description
Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.5.11
References
- GHSA-4fh7-m2wx-6wfm
- firebase.blog
- medium.com
- CVE-2024-51210
- CWE-125
- CWE-200
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
- happy-dom allows for server side code to be executed by a <script> tag - CVE-2024-51757
- AngularJS allows attackers to bypass common image source restrictions - angular - CVE-2024-8373
- secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
You might also like:
- Tags:
- npm
- firepad
Anything's wrong? Let us know Last updated on December 05, 2024