CVE-2024-29073 - Vulnerability Details - OpenCVE

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Ankitects	Anki
Ankiweb	Anki

Configuration 1 [-]

cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992

History

Wed, 11 Sep 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ankiweb Ankiweb anki
CPEs		cpe:2.3:a:ankiweb:anki:24.04:::::::*
Vendors & Products		Ankiweb Ankiweb anki

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-07-22T14:20:27.250Z

Updated: 2024-08-02T01:03:51.703Z

Reserved: 2024-05-06T16:38:05.004Z

Link: CVE-2024-29073

Vulnrichment

Updated: 2024-07-22T16:41:59.136Z

NVD

Status : Modified

Published: 2024-07-22T15:15:02.943

Modified: 2024-11-21T09:07:30.007

Link: CVE-2024-29073

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-29073", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-05-06T16:38:05.004Z", "datePublished": "2024-07-22T14:20:27.250Z", "dateUpdated": "2024-08-02T01:03:51.703Z"}, "containers": {"cna": {"affected": [{"vendor": "Ankitects", "product": "Anki", "versions": [{"version": "24.04", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE", "cweId": "CWE-829"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-07-22T17:00:08.247Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992"}], "credits": [{"lang": "en", "value": "Discovered by Autumn Bee Skerritt of Cisco Duo Security and Jacob B."}]}, "adp": [{"affected": [{"vendor": "ankitects", "product": "anki", "cpes": ["cpe:2.3:a:ankitects:anki:24.04:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "24.04", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-22T16:41:21.314214Z", "id": "CVE-2024-29073", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T16:42:03.769Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:03:51.703Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29073", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-22T16:41:21.314214Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ankitects:anki:24.04:*:*:*:*:*:*:*"], "vendor": "ankitects", "product": "anki", "versions": [{"status": "affected", "version": "24.04"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T16:41:59.136Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Autumn Bee Skerritt of Cisco Duo Security and Jacob B."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Ankitects", "product": "Anki", "versions": [{"status": "affected", "version": "24.04"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992"}], "descriptions": [{"lang": "en", "value": "An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-07-22T17:00:08.247Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29073", "state": "PUBLISHED", "dateUpdated": "2024-07-22T17:00:08.247Z", "dateReserved": "2024-05-06T16:38:05.004Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-07-22T14:20:27.250Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:*", "matchCriteriaId": "C8691462-990E-4992-A762-5D4163718EF4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad en el manejo de Latex en Ankitects Anki 24.04. Cuando se desinfecta Latex para evitar comandos inseguros, se pasa por alto el paquete verbatim, que viene instalado de forma predeterminada en muchas distribuciones de Latex. Una tarjeta flash especialmente manipulada puede provocar la lectura de un archivo arbitrario. Un atacante puede compartir una tarjeta did\u00e1ctica para desencadenar esta vulnerabilidad."}], "id": "CVE-2024-29073", "lastModified": "2024-11-21T09:07:30.007", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "talos-cna@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-22T15:15:02.943", "references": [{"source": "talos-cna@cisco.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "talos-cna@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-829"}], "source": "nvd@nist.gov", "type": "Primary"}]}