CVE-2024-23743

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23743
Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments. NOTE: the vendor states "the attacker must launch the Notion Desktop application with nonstandard flags that turn the Electron-based application into a Node.js execution environment."

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/V3x0r/CVE-2024-23743 Exploit
https://github.com/r3ggi/electroniz3r
https://www.electronjs.org/blog/statement-run-as-node-cves
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:notion:notion:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
History

03 Mar 2024, 00:15

Type Values Removed Values Added
Summary (en) An issue in Notion for macOS version 3.1.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components. (en) Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments. NOTE: the vendor states "the attacker must launch the Notion Desktop application with nonstandard flags that turn the Electron-based application into a Node.js execution environment."
References
  • () https://github.com/r3ggi/electroniz3r -

16 Feb 2024, 16:15

Type Values Removed Values Added
References
  • () https://www.electronjs.org/blog/statement-run-as-node-cves -

13 Feb 2024, 19:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 3.3

01 Feb 2024, 21:12

Type Values Removed Values Added
First Time Apple
Notion
Apple macos
Notion notion
References () https://github.com/V3x0r/CVE-2024-23743 - () https://github.com/V3x0r/CVE-2024-23743 - Exploit
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:a:notion:notion:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo

29 Jan 2024, 14:25

Type Values Removed Values Added
Summary
  • (es) Un problema en Notion para macOS versión 3.1.0 y anteriores permite a atacantes remotos ejecutar código arbitrario a través de los componentes RunAsNode y enableNodeClilnspectArguments.

28 Jan 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-28 02:15

Updated : 2024-04-11 01:24

NVD link : CVE-2024-23743

Mitre link : CVE-2024-23743

CVE.ORG link : CVE-2024-23743

JSON object : View

Products Affected

apple

  • macos

notion

  • notion
CWE
NVD-CWE-noinfo