CVE-2022-43668

2022-12-0704:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-43668

typora

javascript code

security vulnerability

file execution

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.6%

JSON

Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product.

Affected configurations

Vulners

NVD

Node

typoratyporaRange<1.4.4

VendorProductVersionCPE
typoratypora*cpe:2.3:a:typora:typora:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typora	typora	*	cpe:2.3:a:typora:typora::::::::

CNA Affected

[
  {
    "vendor": "Typora",
    "product": "Typora",
    "versions": [
      {
        "version": "versions prior to 1.4.4",
        "status": "affected"
      }
    ]
  }
]