GitHub_MVULNRICHMENT:CVE-2024-38354CVE-2024-38354 Cross-site Scripting in Hackmd.io Notes lead by HTML Injection
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
17.7%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
total
CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.
CNA Affected
[
{
"vendor": "hackmdio",
"product": "codimd",
"versions": [
{
"status": "affected",
"version": "< 2.5.4"
}
]
}
]ADP Affected
[
{
"cpes": [
"cpe:2.3:a:hackmd:codimd:*:*:*:*:*:*:*:*"
],
"vendor": "hackmd",
"product": "codimd",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.5.4",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
17.7%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
total