CVE-2024-41819 - Vulnerability Details - OpenCVE

Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01258.

Key SSVC decision points have not yet been added.

Vendors	Products
Enchantedcode	Note Mark

Configuration 1 [-]

cpe:2.3:a:enchantedcode:note_mark:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-39203	Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182
https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3

History

Fri, 06 Sep 2024 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Enchantedcode Enchantedcode note Mark
CPEs		cpe:2.3:a:enchantedcode:note_mark::::::::
Vendors & Products		Enchantedcode Enchantedcode note Mark

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-07-29T16:03:34.339Z

Updated: 2024-08-05T10:22:35.371Z

Reserved: 2024-07-22T13:57:37.137Z

Link: CVE-2024-41819

Vulnrichment

Updated: 2024-08-02T04:46:53.175Z

NVD

Status : Modified

Published: 2024-07-29T16:15:05.797

Modified: 2024-11-21T09:33:08.247

Link: CVE-2024-41819

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-41819", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-07-22T13:57:37.137Z", "datePublished": "2024-07-29T16:03:34.339Z", "dateUpdated": "2024-08-05T10:22:35.371Z"}, "containers": {"cna": {"title": "Note Mark has a stored XSS in the note link href attribute", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3"}, {"name": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182", "tags": ["x_refsource_MISC"], "url": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182"}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"version": "<= 0.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-29T16:03:34.339Z"}, "descriptions": [{"lang": "en", "value": "Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1."}], "source": {"advisory": "GHSA-rm48-9mqf-8jc3", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:46:53.175Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3"}, {"name": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182"}]}, {"affected": [{"vendor": "enchant97", "product": "note-mark", "cpes": ["cpe:2.3:a:enchant97:note-mark:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.13.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-29T16:50:41.485602Z", "id": "CVE-2024-41819", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T10:22:35.371Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3", "name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182", "name": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:46:53.175Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41819", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-29T16:50:41.485602Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:enchant97:note-mark:*:*:*:*:*:*:*:*"], "vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.13.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-29T17:39:21.252Z"}}], "cna": {"title": "Note Mark has a stored XSS in the note link href attribute", "source": {"advisory": "GHSA-rm48-9mqf-8jc3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "<= 0.13.0"}]}], "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3", "name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182", "name": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-29T16:03:34.339Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41819", "state": "PUBLISHED", "dateUpdated": "2024-08-05T10:22:35.371Z", "dateReserved": "2024-07-22T13:57:37.137Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-07-29T16:03:34.339Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enchantedcode:note_mark:*:*:*:*:*:*:*:*", "matchCriteriaId": "14DDA568-6137-4484-BCEC-9F3A169AFE41", "versionEndExcluding": "0.13.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1."}, {"lang": "es", "value": " Note Mark es una aplicaci\u00f3n de notas Markdown basada en la web. Una vulnerabilidad de Cross Site Scripting (XSS) almacenado en Note Mark permite a los atacantes ejecutar scripts web arbitrarios a trav\u00e9s de un payload manipulado inyectado en el valor URL de un enlace en el contenido de rebajas. Esta vulnerabilidad se solucion\u00f3 en 0.13.1."}], "id": "CVE-2024-41819", "lastModified": "2024-11-21T09:33:08.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-29T16:15:05.797", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}