PT-2018-11820 · Boostnote · Boostnote

Publicado 2018-07-08 · Atualizado 2018-08-28 · CVE-2018-13433

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Boostnote version 0.11.7

Description The issue allows for XSS during the highlighting of Markdown text. This can be demonstrated by an onerror attribute of an IMG element, such as an onerror attribute, which can lead to the execution of malicious code.

Recommendations For Boostnote version 0.11.7, consider disabling the Markdown highlighting feature until a patch is available to prevent potential XSS attacks. Restrict the use of IMG elements with onerror attributes in Markdown text to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-13433

Produtos afetados

Boostnote

Referências · 3

• 🔥 https://github.com/BoostIO/Boostnote/issues/2184 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13433 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13433 · Nota de Segurança