CVE-2024-0849

Summary

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.

Affected Software

Weaknesses

• CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/leanote/desktop-app
• https://fluidattacks.com/advisories/alesso

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/leanote/desktop-app
• https://fluidattacks.com/advisories/alesso

• ←Previous
• Next→