CVE-2022-40277

Опубликовано: 30 сент. 2022

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

Ссылки

https://fluidattacks.com/advisories/skrillex/
Exploit
Third Party Advisory
https://github.com/laurent22/joplin
Product
https://fluidattacks.com/advisories/skrillex/
Exploit
Third Party Advisory
https://github.com/laurent22/joplin
Product

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:-:*:*:*

EPSS

Процентиль: 31%

0.00113

Низкий

7.8 High

CVSS3

Дефекты

CWE-20

Связанные уязвимости

CVE-2022-40277

CVSS3: 7.8

debian

больше 3 лет назад

Joplin version 2.8.8 allows an external attacker to execute arbitrary ...

GHSA-mjr5-v9c9-mm7g

CVSS3: 7.8

github

больше 3 лет назад

Joplin Remote Code Execution

EPSS

Процентиль: 31%

0.00113

Низкий

7.8 High

CVSS3

Дефекты

CWE-20