PT-2023-32274 · Vnotex · Vnotex

Victorootnice · Published 2023-10-22 · Updated 2024-05-17 · CVE-2023-5701

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vnotex vnote versions up to 3.17.0

Description A vulnerability has been found in the Markdown File Handler component, which can be exploited to lead to cross-site scripting. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> can be used to launch a remote attack. The exploit has been disclosed to the public.

Recommendations For versions up to 3.17.0, consider disabling the Markdown File Handler component until a patch is available. Restrict access to potentially vulnerable markdown files to minimize the risk of exploitation. Avoid using the onclick attribute in markdown files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-5701

Affected Products

Vnotex

References · 7

• 🔥 https://github.com/victorootnice/victorootnice.github.io/blob/main/2023/bbp-01.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-5701 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5701 · Vendor Advisory
• https://vuldb.com/?ctiid.243139 · Note
• https://twitter.com/VulmonFeeds/status/1716325729334411695 · Twitter Post
• https://vuldb.com/?id.243139 · Note
• https://twitter.com/CVEnew/status/1716258905246908677 · Twitter Post