Описание
Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls.
Ссылки
- Issue TrackingThird Party Advisory
- ExploitThird Party Advisory
- Issue TrackingThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.5.11 (включая)
cpe:2.3:a:marked_2_project:marked_2:*:*:*:*:*:*:*:*
EPSS
Процентиль: 69%
0.0059
Низкий
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls.
EPSS
Процентиль: 69%
0.0059
Низкий
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-200