by Kastro
Paper/Archive/CVE-2024-2692

CVE-2024-2692

SiYuan SiYuan — SiYuan 3.0.3 - RCE via Server Side XSS

EPSS 0.7%public exploitCVSS 9.0
critical.is priorityof 100
48
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 54.3.543 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.

Affected

ProductAffectedFixed inSource
SiYuan3.0.3–CNA
siyuan3.0.3–CISA-ADP

Scores by source

Fluid Attacks (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

reffluidattacks.com/advisories/dezcorefgithub.com/siyuan-note/siyuan