{"id":"CVE-2024-7739","state":"PUBLISHED","title":"yzane vscode-markdown-pdf cross site scripting","description":"A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2024-08-13T19:00:10.511Z","updatedAt":"2024-08-13T20:09:53.132Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["yzane vscode-markdown-pdf"],"affected":[{"vendor":"yzane","product":"vscode-markdown-pdf","versions":[{"version":"1.5.0","status":"affected"}]}],"references":["https://vuldb.com/?id.274359","https://vuldb.com/?ctiid.274359","https://vuldb.com/?submit.385635","https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/script_injection_report.md","https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/poc_script_inject.mp4"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7739.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7739","state":"PUBLISHED","datePublished":"2024-08-13T19:00:10.511Z","dateUpdated":"2024-08-13T20:09:53.132Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-08-13T14:03:22.933Z"},"containers":{"cna":{"title":"yzane vscode-markdown-pdf cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in yzane vscode-markdown-pdf 1.5.0 gefunden. Betroffen hiervon ist ein unbekannter Ablauf. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"yzane","product":"vscode-markdown-pdf","versions":[{"version":"1.5.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.274359","name":"VDB-274359 | yzane vscode-markdown-pdf cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.274359","name":"VDB-274359 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.385635","name":"Submit #385635 | yzane Markdown PDF Vscode Extension 1.5.0 Javascript Injection","tags":["third-party-advisory"]},{"url":"https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/script_injection_report.md","tags":["exploit"]},{"url":"https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/poc_script_inject.mp4","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Cross Site Scripting"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-08-13T19:00:10.511Z"},"timeline":[{"time":"2024-08-13T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-08-13T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-08-13T16:08:47.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"abhi-ingle (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"yzane","product":"vscode_markdown_pdf","defaultStatus":"unknown","versions":[{"version":"1.5.0","status":"affected"}],"cpes":["cpe:2.3:a:yzane:vscode_markdown_pdf:1.5.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-13T20:05:05.174147Z","id":"CVE-2024-7739","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-13T20:09:53.132Z"}}]}}}