by Kastro
Paper/Archive/CVE-2022-36450

CVE-2022-36450

mitre — Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without che…

EPSS 21%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.5.975 × 2019.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre (CNA)8.0CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:R

References

refforum.obsidian.md/t/possible-remote-code-execution-through-obsidian-uri-scheme/39743refchtsecurity.com/news/f2a1ad21-3442-495f-8b6e-f0fe433d6caa