PT-2019-12685 · Boostnote · Boostnote

Publicado 2019-05-19 · Atualizado 2019-05-20 · CVE-2019-12184

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Boostnote version 0.11.15

Description The issue is related to a XSS in the browser/components/MarkdownPreview.js component. It can be triggered via a label named flowchart, sequence, gallery, or chart. A crafted SRC attribute of an IFRAME element can be used to exploit this issue.

Recommendations For Boostnote version 0.11.15, consider disabling the Markdown preview feature until a patch is available. Restrict access to the MarkdownPreview.js component to minimize the risk of exploitation. Avoid using labels named flowchart, sequence, gallery, or chart in the affected component until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12184

Produtos afetados

Boostnote

Referências · 3

• 🔥 https://gist.github.com/rebirthwyw/9836b2445abd4c1358e3d68ff2415247 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12184 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12184 · Aviso do Fabricante