CVE-2023-31873

Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').

Gin v0.7.4 permite la ejecución de código arbitrario cuando un archivo manipulado esta abierto, por ejemplo, a través de: require('child_process').

Gin Markdown Editor version 0.7.4 suffers from an arbitrary code execution vulnerability.

*Credits: N/A

CVSS Scores

NISTv3.1 7.8

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-04-29 CVE Reserved
2023-05-23 First Exploit
2023-05-24 CVE Published
2024-06-29 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC
https://www.exploit-db.com/exploits/51469	2023-05-23
http://packetstormsecurity.com/files/172530/Gin-Markdown-Editor-0.7.4-Arbitrary-Code-Execution.html	2024-08-02

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gin Project Search vendor "Gin Project"		Gin Search vendor "Gin Project" for product "Gin"				0.7.4 Search vendor "Gin Project" for product "Gin" and version "0.7.4"		-		Affected