CVE-2023-27035: High severity obsidian vulnerability

Published May 1, 2023

Updated

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.

Affected Software

1 affected component

Obsidian Obsidian=1.1.9

Event History

May 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-27035?

The severity of CVE-2023-27035 is high with a score of 7.5.

How does CVE-2023-27035 impact Obsidian Canvas?

CVE-2023-27035 allows remote attackers to send desktop notifications, record user audio, and potentially cause other unspecified impacts via an embedded website on the canvas page.

How can I fix CVE-2023-27035 in Obsidian Canvas?

There is no official fix available yet for CVE-2023-27035 in Obsidian Canvas. It is recommended to monitor for any updates or patches from the vendor.

Where can I find more information about CVE-2023-27035?

You can find more information about CVE-2023-27035 on the following references: [Reference 1](https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509), [Reference 2](https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595), [Reference 3](https://github.com/fivex3/CVE-2023-27035).

What CWE category does CVE-2023-27035 belong to?

CVE-2023-27035 belongs to CWE category 276.