VulnerabilityModified
CVE-2018-18524
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.
MEDIUM 6.1EPSS 1.94%
Does this matter?
Lower severity and a low EPSS score (1.94%). Track it; it rarely justifies an emergency change on its own.
Description
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.94% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- evernote/evernote
- Source
- cve@mitre.org
References
- https://evernote.com/intl/en/security/updatesVendor Advisory
- https://paper.seebug.org/737/Exploit, Third Party Advisory
- https://evernote.com/intl/en/security/updatesVendor Advisory
- https://paper.seebug.org/737/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.