CVE-2018-9327

Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).

Score

CVSS 3.0 8.1 High

Status

Modified - cve@mitre.org

Published

2018-04-07

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Etherpad (Etherpad)

References

• http://blog.etherpad.org/2018/04/07/important-release-1-6-4/