Ether
Monthly
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. A vendor patch exists in 3.3.1; no public exploit identified at time of analysis, though the vendor's regression test embeds a working payload.
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, but the fix is straightforward to reverse-engineer from the public patch.
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. A vendor patch exists in 3.3.1; no public exploit identified at time of analysis, though the vendor's regression test embeds a working payload.
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, but the fix is straightforward to reverse-engineer from the public patch.