CVE-2023-0835

2023-04-0423:15:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-0835

markdown-pdf

remote access

nvd

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.4%

JSON

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.

Affected configurations

NVD

Node

markdown-pdf_projectmarkdown-pdfMatch11.0.0node.js

CPENameOperatorVersion
markdown-pdf_project:markdown-pdfmarkdown-pdf project markdown-pdfeq11.0.0

CPE	Name	Operator	Version
markdown-pdf_project:markdown-pdf	markdown-pdf project markdown-pdf	eq	11.0.0

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "markdown-pdf",
    "versions": [
      {
        "version": "11.0.0",
        "status": "affected"
      }
    ]
  }
]