PT-2020-14875 · Notable · Notable

Published 2020-12-10 · Updated 2020-12-11 · CVE-2020-16608

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notable version 1.8.4

Description The issue allows for XSS via crafted Markdown text, resulting in remote code execution because nodeIntegration in webPreferences is set to true.

Recommendations For version 1.8.4, consider disabling the nodeIntegration in webPreferences to prevent remote code execution until a patch is available. Restrict the use of crafted Markdown text to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-16608

Affected Products

Notable

References · 11

• 🔥 https://sghosh2402.medium.com/cve-2020-16608-8cdad9f4d9b4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-16608 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16608 · Vendor Advisory
• https://github.com/notable/notable · Note
• https://t.me/cibsecurity/19698 · Telegram Post
• https://t.me/cibsecurity/19638 · Telegram Post
• https://t.me/cibsecurity/19658 · Telegram Post
• https://t.me/cibsecurity/19718 · Telegram Post
• https://t.me/cibsecurity/19758 · Telegram Post
• https://t.me/cibsecurity/19738 · Telegram Post
• https://t.me/cibsecurity/19678 · Telegram Post