Lucene search
PRIOn knowledge basePRION:CVE-2022-40276HistoryNov 03, 2022 - 8:15 p.m.
Xxe
2022-11-0320:15:00
PRIOn knowledge base
www.prio-n.com
1
xxe
arbitrary access
remote attack
markdown files
application security
csp policy
file validation
nvd
Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Zettlr. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
Related
osv
osv
CVE-2022-40276
2022-11-03 20:15:31
cvelist
cvelist
CVE-2022-40276
2022-11-03 00:00:00
nvd
nvd
CVE-2022-40276
2022-11-03 20:15:31
cve
cve
CVE-2022-40276
2022-11-03 20:15:31
cnvd
cnvd
Zettlr input validation error vulnerability
2022-11-07 00:00:00