8.2
CVE-2023-0835
- EPSS 0.6%
- Veröffentlicht 04.04.2023 23:15:07
- Zuletzt bearbeitet 13.02.2025 16:15:37
- Quelle help@fluidattacks.com
- CVE-Watchlists
- Unerledigt
Loginmarkdown-pdf 11.0.0 - Local File Read via Server Side XSS
markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Markdown-pdf Project ≫ Markdown-pdf Version11.0.0 SwPlatformnode.js
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.6% | 0.439 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.2 | 2.8 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.2 | 2.8 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://fluidattacks.com/advisories/relsb/
https://www.npmjs.com/package/markdown-pdf/