Lucene search

GoogleOSV:CVE-2023-27035

HistoryMay 01, 2023 - 10:15 p.m.

CVE-2023-27035

2023-05-0122:15:09

Google

osv.dev

obsidian canvas

remote attack

desktop notifications

user audio

impact

embedded website

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.7%

JSON

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.

CPENameOperatorVersion
obsidian-releaseseq0.8.4
obsidian-releaseseq0.12.5
obsidian-releaseseq0.12.14
obsidian-releaseseq0.14.2
obsidian-releaseseq0.9.4
obsidian-releaseseq0.12.11
obsidian-releaseseq0.10.12
obsidian-releaseseq0.9.6
obsidian-releaseseq0.8.10
obsidian-releaseseq0.9.5

Name	Operator	Version
obsidian-releases	eq	0.8.4
obsidian-releases	eq	0.12.5
obsidian-releases	eq	0.12.14
obsidian-releases	eq	0.14.2
obsidian-releases	eq	0.9.4
obsidian-releases	eq	0.12.11
obsidian-releases	eq	0.10.12
obsidian-releases	eq	0.9.6
obsidian-releases	eq	0.8.10
obsidian-releases	eq	0.9.5

Rows per page:

1-10 of 1251

References

forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509

forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595

github.com/fivex3/CVE-2023-27035

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.7%

JSON

Related for OSV:CVE-2023-27035