{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7739","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2024-08-13T14:03:22.933Z","datePublished":"2024-08-13T19:00:10.511Z","dateUpdated":"2024-08-13T20:09:53.132Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2024-08-13T19:00:10.511Z"},"title":"yzane vscode-markdown-pdf cross site scripting","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-79","lang":"en","description":"CWE-79 Cross Site Scripting"}]}],"affected":[{"vendor":"yzane","product":"vscode-markdown-pdf","versions":[{"version":"1.5.0","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in yzane vscode-markdown-pdf 1.5.0 gefunden. Betroffen hiervon ist ein unbekannter Ablauf. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N"}}],"timeline":[{"time":"2024-08-13T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-08-13T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-08-13T16:08:47.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"abhi-ingle (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.274359","name":"VDB-274359 | yzane vscode-markdown-pdf cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.274359","name":"VDB-274359 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.385635","name":"Submit #385635 | yzane Markdown PDF Vscode Extension 1.5.0 Javascript Injection","tags":["third-party-advisory"]},{"url":"https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/script_injection_report.md","tags":["exploit"]},{"url":"https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/poc_script_inject.mp4","tags":["exploit"]}]},"adp":[{"affected":[{"vendor":"yzane","product":"vscode_markdown_pdf","cpes":["cpe:2.3:a:yzane:vscode_markdown_pdf:1.5.0:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"1.5.0","status":"affected"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-13T20:05:05.174147Z","id":"CVE-2024-7739","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-08-13T20:09:53.132Z"}}]}}