PT-2023-20910 · Unknown · Obsidian Canvas

Fivexthree · Publicado 2023-05-01 · Atualizado 2025-01-30 · CVE-2023-27035

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Obsidian Canvas version 1.1.9

Description An issue in Obsidian Canvas allows remote attackers to send desktop notifications, record user audio, and potentially have other unspecified impacts. This can be achieved via an embedded website on the canvas page.

Recommendations For Obsidian Canvas version 1.1.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2023-27035

Produtos afetados

Obsidian Canvas

Referências · 7

• 🔥 https://github.com/fivex3/CVE-2023-27035 · Exploit
• 🔥 https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509 · Exploit
• https://t.me/cvenotify/109219 · Publicação no Telegram
• https://t.me/cvenotify/49573 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27035 · Aviso do Fabricante
• https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-27035 · Nota de Segurança