PT-2022-18809 · Unknown · Turtlapp Turtle Note

Muhammad Samak + 1 · Published 2022-04-28 · Updated 2022-05-06 · CVE-2022-28101

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Turtlapp Turtle Note version 0.7.2.6

Description The issue allows attackers to execute HTML injection due to the lack of filtering of the tag during markdown parsing.

Recommendations For version 0.7.2.6, as a temporary workaround, consider disabling markdown parsing until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28101

Affected Products

Turtlapp Turtle Note

References · 5

• 🔥 https://github.com/turtl/tracker/issues/404 · Exploit
• 🔥 https://cybercitadel.com/html-injection-turtl · Exploit
• https://osv.dev/vulnerability/CVE-2022-28101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28101 · Security Note
• https://t.me/cibsecurity/41570 · Telegram Post