GitHub Advisoryadvisory · npm

GHSA-4fh7-m2wx-6wfm Firepad allows insecure document access

LOW Published 2024-12-04 Modified 2024-12-05 Official page ↗
Aliases
CVE-2024-51210
Ecosystem
npm
Packages
firepad
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-125, CWE-200
Reviewed
2024-12-04

Affected packages

• npm firepad: <= 1.5.11 (no fix yet)

Description

Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2024-51210 Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all… vulnerability

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References