PT-2023-32274 · Vnotex · Vnotex

Victorootnice · Publicado 2023-10-22 · Atualizado 2024-05-17 · CVE-2023-5701

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vnotex vnote versions up to 3.17.0

Description A vulnerability has been found in the Markdown File Handler component, which can be exploited to lead to cross-site scripting. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> can be used to launch a remote attack. The exploit has been disclosed to the public.

Recommendations For versions up to 3.17.0, consider disabling the Markdown File Handler component until a patch is available. Restrict access to potentially vulnerable markdown files to minimize the risk of exploitation. Avoid using the onclick attribute in markdown files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-5701

Produtos afetados

Vnotex

Referências · 7

• 🔥 https://github.com/victorootnice/victorootnice.github.io/blob/main/2023/bbp-01.md · Exploit
• https://vuldb.com/?ctiid.243139 · Nota
• https://twitter.com/VulmonFeeds/status/1716325729334411695 · Publicação no Twitter
• https://vuldb.com/?id.243139 · Nota
• https://twitter.com/CVEnew/status/1716258905246908677 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5701 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-5701 · Aviso do Fabricante