PT-2023-20910 · Unknown · Obsidian Canvas

Fivexthree · Published 2023-05-01 · Updated 2025-01-30 · CVE-2023-27035

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Obsidian Canvas version 1.1.9

Description An issue in Obsidian Canvas allows remote attackers to send desktop notifications, record user audio, and potentially have other unspecified impacts. This can be achieved via an embedded website on the canvas page.

Recommendations For Obsidian Canvas version 1.1.9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-27035

Affected Products

Obsidian Canvas

References · 7

• 🔥 https://github.com/fivex3/CVE-2023-27035 · Exploit
• 🔥 https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509 · Exploit
• https://osv.dev/vulnerability/CVE-2023-27035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27035 · Security Note
• https://t.me/cvenotify/109219 · Telegram Post
• https://t.me/cvenotify/49573 · Telegram Post
• https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595 · Note