GCVE - cpe:2.3:a:etherpad:etherpad:1.5.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:etherpad:etherpad:1.5.0:*:*:*:*:*:*:*

part: a version: 1.5.0 update: *

Vendor	Etherpad (`8a5984ba-1c83-5482-9437-f625ec3b5a76`)
Product	Etherpad (`87f42a0c-15a4-51f4-aedd-d403d2adb00b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/ether/etherpad-lite`	purl2cpe	2026-06-01 10:15:25.001189

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-3297`	vulnerable	2026-06-08 05:06:37.939260	Details available Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests. Published: 2017-07-07T16:00:00.000Z Updated: 2024-08-06T05:39:32.148Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/04/11/1 http://www.securityfocus.com/bid/74056 https://github.com/ether/etherpad-lite/commit/9d4e5f6 http://www.openwall.com/lists/oss-security/2015/04/12/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2298`	vulnerable	2026-06-08 05:06:27.889918	Details available node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID. Published: 2018-01-12T17:00:00.000Z Updated: 2024-08-06T05:10:15.993Z Open on db.gcve.eu Reference links https://github.com/ether/etherpad-lite/commit/a0fb65205c7d7ff95f00eb9fd88e93b300f30c3d https://github.com/ether/etherpad-lite/releases/tag/1.5.2 http://www.openwall.com/lists/oss-security/2015/03/15/3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.