CVE-2024-23745
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Notion是Notion公司的一款集成了笔记、知识库、数据表格、看板、日历等多种能力于一体的应用程序。 Notion Web Clipper 1.0.3版本存在安全漏洞，该漏洞源于 NIB 文件可以被操纵来执行任意命令。
Possible ATT&CK Techniques 2 AI
T1211 · Exploitation for Stealth T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-23745
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Notion Web Clipper 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Notion是Notion公司的一款集成了笔记、知识库、数据表格、看板、日历等多种能力于一体的应用程序。 Notion Web Clipper 1.0.3版本存在安全漏洞，该漏洞源于 NIB 文件可以被操纵来执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2024-23745
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. | https://github.com/louiselalanne/CVE-2024-23745 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-23745
请登录查看更多情报信息。
Security Blog Posts for CVE-2024-23745 (1)
Other References for CVE-2024-23745 (2)
Same Patch Batch · n/a · 2024-01-31 · 17 CVEs total
| CVE-2023-6246 | 8.4 HIGH | Glibc: heap-based buffer overflow in __vsyslog_internal() |
| CVE-2023-6779 | 8.2 HIGH | Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal() |
| CVE-2024-1117 | 7.3 HIGH | openBI Screen.php index code injection |
| CVE-2024-1116 | 7.3 HIGH | openBI Upload.php index unrestricted upload |
| CVE-2024-1115 | 7.3 HIGH | openBI Setting.php dlfile os command injection |
| CVE-2024-1114 | 6.5 MEDIUM | openBI Screen.php dlfile access control |
| CVE-2023-2439 | 6.4 MEDIUM | WordPress plugin UserPro 安全漏洞 |
| CVE-2024-1113 | 6.3 MEDIUM | openBI Unity.php uploadUnity unrestricted upload |
| CVE-2023-6780 | 5.3 MEDIUM | Glibc: integer overflow in __vsyslog_internal() |
| CVE-2024-1098 | 4.3 MEDIUM | Rebuild proxy-download QiniuCloud.getStorageFile information disclosure |
| CVE-2024-1099 | 3.5 LOW | Rebuild read-raw getFileOfData cross site scripting |
| CVE-2024-22569 | POSCMS 安全漏洞 | |
| CVE-2023-31505 | Schlix CMS 安全漏洞 | |
| CVE-2024-23170 | Mbed TLS 安全漏洞 | |
| CVE-2024-23775 | Mbed TLS 安全漏洞 | |
| CVE-2022-47072 | 编号已被CVE保留 |
IV. Related Vulnerabilities
V. Comments for CVE-2024-23745
No comments yet