PT-2019-9601 · Evernote · Evernote

Tongqing Zhu · Published 2019-05-13 · Updated 2019-05-13 · CVE-2018-18524

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Evernote version 6.15

Description The issue is related to an incorrectly repaired stored XSS vulnerability. An attacker can exploit this to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution of commands on the victim's computer.

Recommendations For Evernote version 6.15, consider disabling the Present mode feature until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to sensitive files and avoid opening notes from untrusted sources to minimize the risk of remote command execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-18524

Affected Products

Evernote

References · 4

• 🔥 https://paper.seebug.org/737 · Exploit
• https://evernote.com/intl/en/security/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18524 · Security Note