CVE-2020-22785

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 1.8.3

Description The issue is related to a missing lock check, which could cause a denial of service. An attack involving aggressively targeting random pad import endpoints with empty data could flatten all pads due to the lack of rate limiting and a missing ownership check.

Recommendations For versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider implementing rate limiting on pad import endpoints to minimize the risk of exploitation. Restrict access to pad import endpoints to prevent aggressively targeting with empty data.