How severe is CVE-2022-41710?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.5 out of 10.

What type of vulnerability is CVE-2022-41710?

This is classified as CWE-552, which is a common weakness in software security.

CVE-2022-41710 - MEDIUM Severity | CVSS 5.5

Vulnerability Description

Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.

Related Vulnerabilities

CVE-2015-1350

MEDIUM

CVSS:5.5(Medium)

The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to caus...

CWE-5522015

CVE-2016-3715

MEDIUM

CVSS:5.5(Medium)

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

CWE-5522016

CVE-2017-11829

MEDIUM

CVSS:5.5(Medium)

Microsoft Windows 10 allows an elevation of privilege vulnerability when the Windows Update Delivery Optimization does not properly enforce file share permissions.

CWE-5522017

CVE-2017-2622

MEDIUM

CVSS:5.5(Medium)

An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access ...

CWE-5522017

CVE-2017-7079

MEDIUM

CVSS:5.5(Medium)

An issue was discovered in certain Apple products. iTunes before 12.7 is affected. The issue involves the "Data Sync" component. It allows attackers to access iOS backups (written by iTunes) via a cra...

CWE-5522017

CVE-2019-0381

MEDIUM

CVSS:5.5(Medium)

A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in dir...

CWE-5522019