8.8

CVE-2020-17759

An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Evernote ≫ Evernote Version6.17.7 SwPlatformwindows
   Microsoft ≫ Windows 10 Version-
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows Server 2008 Version-
Evernote ≫ Evernote Version6.18 Updatebeta2 SwPlatformwindows
   Microsoft ≫ Windows 10 Version-
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows Server 2008 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.636
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.