PT-2018-16188 · Npm · Markdown-Pdf

CVE-2018-3770 · Publicado 2018-07-20 · Atualizado 2023-02-28

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions markdown-pdf versions prior to 9.0.0

Description A path traversal issue in markdown-pdf allows users to insert malicious HTML code, potentially resulting in the reading of local files. The package fails to sanitize HTML code in markdown files, which can lead to Remote Code Execution when markdown files with malicious HTML are converted to PDF. This may allow attackers to execute remote code if the resulting PDF file contains JavaScript code from the original markdown file.

Recommendations For versions prior to 9.0.0, upgrade to version 9.0.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-3770

GHSA-P7C9-JQHQ-VR3V

Produtos afetados

Markdown-Pdf

Referências · 6

• 🔥 https://hackerone.com/reports/360727 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3770 · Nota de Segurança
• https://github.com/advisories/GHSA-p7c9-jqhq-vr3v · Nota
• https://npmjs.com/advisories/991 · Nota
• https://osv.dev/vulnerability/CVE-2018-3770 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p7c9-jqhq-vr3v · Aviso do Fabricante