CVE-2015-3297

Estado: ModificadaAlta (7.5)—
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
CVSS

Versión: 3.0
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 4.96%
Percentil entre todas las CVEs puntuadas: 92
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Etherpad — Etherpad
CWE

CWE-22
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-3297",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-07T16:29:00.173",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/11/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/12/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74056",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ether/etherpad-lite/commit/9d4e5f6",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/11/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/12/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74056",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ether/etherpad-lite/commit/9d4e5f6",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de salto de directorio en node/utils/Minify.js en Etherpad desde la versión 1.1.1 hasta la 1.5.2 permite que atacantes remotos lean archivos arbitrarios aprovechando el reemplazo de barras diagonales inversas por barras diagonales en el parámetro path de peticiones API HTTP."
    }
  ],
  "lastModified": "2026-06-17T00:25:41.613",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E21B176-6B0C-4EC9-AC85-814CCD7B02AB"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A021FEF-DBC8-455A-945A-96CE411091C0"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CBB9277-A9C7-4979-8CD6-5DAF20B21022"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B5085F7-7BF6-4C34-9D2D-2738A49B21D9"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "643BCCDE-77EF-4551-8CAD-390C4AB0289E"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41A2C651-7345-4354-B112-21DBCD176BF9"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86DC65D6-8950-4EF2-880E-2916AAB2B544"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "810D72F9-71E7-47A8-9496-7EF0F7F96BAF"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4F28C6F-31ED-4A86-A8CB-A7F3FE80463D"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "554B75F7-6CF0-47AD-AB49-1519DC5E5FC1"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47725F83-A7FB-47AC-9868-EEC0D9BE7F85"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "856989B3-F1CA-4CE3-8B0D-BF1D040FF407"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00362C25-0438-4928-866C-7BE99C569987"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "272184D3-C079-4D69-9C99-B9C22576DD15"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3ECA2014-464B-4140-9B22-9704DB16274B"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA27831F-08D4-488A-922F-D0FA210A9882"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C5829CF-4DBB-44CD-B989-F5D3A4EC6D9E"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5629C43A-9910-45EA-A43F-C7CA22FC4434"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.81:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9865B41A-F7BA-4281-AE08-5E9D821C5310"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.2.91:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CD2B7A2-34F9-48EB-90E5-93C8D2167D75"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2C42AC6-B0C9-4468-BD0D-589916E29AAB"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08B94664-ED9A-4459-B84E-9D552A6C4EEF"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDD7903B-96A0-4022-ADD8-306155E4595B"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB82785A-1099-4730-9782-803F0577EFDE"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB1BC2A6-1B10-457A-AC41-F500CABF8C41"
            },
            {
              "criteria": "cpe:2.3:a:etherpad:etherpad:1.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04955F09-99FB-4B0B-BA82-84EF7B5EB859"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}