Lucene search

Japan Vulnerability NotesJVN:26044739

HistoryNov 21, 2022 - 12:00 a.m.

JVN#26044739: Typora fails to properly neutralize JavaScript code

2022-11-2100:00:00

Japan Vulnerability Notes

jvn.jp

typora

javascript

cwe-116

update

version 1.4.4

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

33.7%

JSON

Typora fails to properly neutralize JavaScript code (CWE-116).

Impact

Opening a file with the affected product may lead to execute the JavaScript code inside the file.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

The developer confirms the vulnerability is fixed in Typora versions 1.4.x.
The reporter confirms that Typora version 1.4.4 is not affected.

Products Affected

Typora versions prior to 1.4.4

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

33.7%

JSON

Related for JVN:26044739