CVE-2023-2971

🗓️ 19 Aug 2023 05:45:35Reported by STAR_LabsType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Improper path handling in Typora before 1.7.0-dev allows crafted webpage to access local files and exfiltrate them to remote web servers

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-2971	19 Aug 202312:39	–	circl
CNNVD	Typora 路径遍历漏洞	19 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-2971 Typora Local File Disclosure	19 Aug 202305:45	–	cvelist
EUVD	EUVD-2023-34415	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2971	19 Aug 202306:15	–	nvd
Prion	Design/Logic Flaw	19 Aug 202306:15	–	prion
Positive Technologies	PT-2023-22366 · Typora · Typora	18 Aug 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-2971	23 May 202501:50	–	redhatcve
Vulnrichment	CVE-2023-2971 Typora Local File Disclosure	19 Aug 202305:45	–	vulnrichment

NVD

Node

typora typoraRange≤1.6.7

AND

linux linux_kernelMatch-

microsoft windowsMatch-

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "Typora",
    "vendor": "Typora",
    "versions": [
      {
        "lessThan": "1.7.0-dev",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
starlabs	www.starlabs.sg/advisories/23/23-2971/

Parameter	Position	Path	Description	CWE
typora://app/typemark/	path	typora://app/typemark/	Improper path handling allows local files to be accessed via Typora's protocol handler when a malicious page triggers typora://app/typemark/.	CWE-22

21 Nov 2024 07:59Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.3 - 6.5

EPSS0.00126

SSVC

CWE-22