CVE-2019-15302

6.5MEDIUM

Key Information:

Vendor
Xwiki
Status
Cryptpad
Vendor
CVE Published:
11 September 2019

Summary

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification.

References

https://github.com/xwiki-labs/cryptpad/commits/staging
x_refsource_MISC
https://github.com/xwiki-labs/cryptpad/releases/tag/3.0.0
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.