PT-2023-16559 · Unknown · Markdown-Pdf

Carlos Bello · CVE-2023-0835 · Publicado 2023-04-04 · Atualizado 2023-04-13

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions markdown-pdf version 11.0.0

Description The issue allows an external attacker to remotely obtain arbitrary local files due to the application's failure to validate the Markdown content entered by the user.

Recommendations For markdown-pdf version 11.0.0, update to a version that includes input validation for Markdown content to prevent unauthorized access to local files.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-0835

GHSA-QGHR-877H-F9JH

Produtos afetados

Markdown-Pdf

Referências · 6

• 🔥 https://fluidattacks.com/advisories/relsb · Exploit
• https://github.com/alanshaw/markdown-pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-0835 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qghr-877h-f9jh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0835 · Aviso do Fabricante
• https://npmjs.com/package/markdown-pdf · Nota