Threats tagged 'ghsa-fjgc-3mj7-8rg8'

A vulnerability in ep_etherpad-lite versions 2.1.0 through 3.0.0 allows an attacker to exploit the x-proxy-path HTTP header to perform cache-poisoning cross-site scripting (XSS) attacks on the admin interface and an open redirect via the timeslider feature. The x-proxy-path header is reflected unsanitized into admin HTML/JS/CSS assets and used in redirects without proper validation. This can lead to XSS attacks against administrators and phishing via open redirects. The flaw is fixed in version 3.1.0.