CVE-2024-0849

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0849
Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fluidattacks.com/advisories/alesso Third Party Advisory
https://github.com/leanote/desktop-app Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:leanote:desktop:2.7.0:*:*:*:*:*:*:*
History

13 Feb 2024, 19:16

Type Values Removed Values Added
CPE cpe:2.3:a:leanote:desktop:2.7.0:*:*:*:*:*:*:*
First Time Leanote desktop
Leanote
CWE CWE-22
References () https://fluidattacks.com/advisories/alesso - () https://fluidattacks.com/advisories/alesso - Third Party Advisory
References () https://github.com/leanote/desktop-app - () https://github.com/leanote/desktop-app - Product

07 Feb 2024, 13:41

Type Values Removed Values Added
Summary
  • (es) La versión 2.7.0 de Leanote permite obtener archivos locales arbitrarios. Esto es posible porque la aplicación es vulnerable a LFR.

07 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-07 03:15

Updated : 2024-02-13 19:16

NVD link : CVE-2024-0849

Mitre link : CVE-2024-0849

CVE.ORG link : CVE-2024-0849

JSON object : View

Products Affected

leanote

  • desktop
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-20

Improper Input Validation