CVE-2022-29281

Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link

published April 15, 2022

CVSS
—
EPSS
2%
Percentile
75.3
In the wild
Unconfirmed
What it is

Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program (or theft of NTLM credentials via an SMB relay attack, because the application resolves UNC paths).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01578 · 75.3th percentile
Published
2022-04-15T20:41Z
EPSS history
Timeline
  • 15 APR 20:41Z
    Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link
    cvelistv5