CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992	Exploit Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-22 15:15

Updated : 2024-11-21 09:07

NVD link : CVE-2024-29073

Mitre link : CVE-2024-29073

CVE.ORG link : CVE-2024-29073

JSON object : View

Products Affected

ankiweb

anki

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2024-29073", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-07-22T15:15:02.943", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-829"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad en el manejo de Latex en Ankitects Anki 24.04. Cuando se desinfecta Latex para evitar comandos inseguros, se pasa por alto el paquete verbatim, que viene instalado de forma predeterminada en muchas distribuciones de Latex. Una tarjeta flash especialmente manipulada puede provocar la lectura de un archivo arbitrario. Un atacante puede compartir una tarjeta did\u00e1ctica para desencadenar esta vulnerabilidad."}], "lastModified": "2024-11-21T09:07:30.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8691462-990E-4992-A762-5D4163718EF4"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}