CVE-2020-22784

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-28 · updated 2026-06-17
Weakness: CWE-697

Description

In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.

Affected products

Etherpad Ueberdb: before 1.4.8 — fixed in 1.4.8

How to fix

Upgrade to a fixed version: Etherpad Ueberdb 1.4.8. Check the vendor advisory for mitigations.

References

https://github.com/ether/ueberDB/commit/e8b58d03534ade8d83c2d1946a8350a23952531e
https://github.com/ether/ueberDB/commit/e8b58d03534ade8d83c2d1946a8350a23952531e

Get alerted when CVE-2020-22784 or the next vulnerability affects your stack