PT-2019-9601 · Evernote · Evernote

Tongqing Zhu · Publicado 2019-05-13 · Atualizado 2019-05-13 · CVE-2018-18524

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Evernote version 6.15

Description The issue is related to an incorrectly repaired stored XSS vulnerability. An attacker can exploit this to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution of commands on the victim's computer.

Recommendations For Evernote version 6.15, consider disabling the Present mode feature until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to sensitive files and avoid opening notes from untrusted sources to minimize the risk of remote command execution.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18524

Produtos afetados

Evernote

Referências · 4

• 🔥 https://paper.seebug.org/737 · Exploit
• https://evernote.com/intl/en/security/updates · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-18524 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18524 · Nota de Segurança