Summaryinfo

A vulnerability categorized as problematic has been discovered in Obsidian up to 0.15.4. Impacted is an unknown function of the component URL Handler. Such manipulation leads to an unknown weakness. This vulnerability is listed as CVE-2022-36450. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Obsidian up to 0.15.4. Affected by this issue is an unknown functionality of the component URL Handler. The manipulation with an unknown input leads to a code vulnerability. Using CWE to declare the problem leads to CWE-17. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.

The weakness was presented 07/25/2022. The advisory is shared for download at forum.obsidian.md. This vulnerability is handled as CVE-2022-36450 since 07/25/2022. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.15.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Obsidian

Version

• 0.15.0
• 0.15.1
• 0.15.2
• 0.15.3
• 0.15.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion