PT-2019-12653
CVE-2019-12138
·
Published
2019-05-16
·
Updated
2019-05-16
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
MacDown version 0.7.1
Description
The issue allows directory traversal, enabling the execution of arbitrary programs. This can be achieved by including a
file:/// or ../ substring in a shared note.Recommendations
For MacDown version 0.7.1, consider avoiding the use of
file:/// or ../ substrings in shared notes until a fix is available. As a temporary workaround, restrict access to shared notes to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾