Wiz
Vulnerability DatabaseCVE-2024-31784

CVE-2024-31784: 
Typora vulnerability analysis and mitigation

Overview

A vulnerability has been identified in Typora version 1.8.10 and earlier versions that allows local attackers to obtain sensitive information and execute arbitrary code through a crafted payload targeting the src component (NVD). The vulnerability was disclosed on April 16, 2024, and is tracked as CVE-2024-31784.

Technical details

The vulnerability involves a security issue where dragging URLs from cross-domain iframes that are deleted during the drag process can lead to user confusion and website spoofing attacks. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L (NVD, GitHub POC).

Impact

The vulnerability can result in sensitive information disclosure and potential arbitrary code execution when a crafted payload is delivered to the src component. Additionally, it can lead to website spoofing attacks through manipulation of cross-domain iframe behavior (GitHub POC).

Mitigation and workarounds

Users are advised to upgrade to a version newer than Typora 1.8.10 once available. As of the vulnerability disclosure, no official patch has been publicly announced (NVD).

Additional resources

Source: This report was generated using AI

Related Typora vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2024-33300HIGH7.3
  • TyporaTypora
  • cpe:2.3:a:typora:typora
NoYesMay 01, 2024
CVE-2024-41482MEDIUM6.1
  • TyporaTypora
  • cpe:2.3:a:typora:typora
NoYesAug 12, 2024
CVE-2024-41481MEDIUM6.1
  • TyporaTypora
  • cpe:2.3:a:typora:typora
NoYesAug 12, 2024
CVE-2024-31784MEDIUM6.1
  • TyporaTypora
  • typora
NoYesApr 16, 2024
CVE-2024-31783MEDIUM6.1
  • TyporaTypora
  • cpe:2.3:a:typora:typora
NoYesApr 16, 2024

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo