CVE-2019-12592

—

CVSS 3.0

6.1 medium

EPSS

1%p63

Published

Jun 18, 2019 (Jun 18, 2019)

Modified

Jun 17, 2026

Description

A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.

Vendors: evernote
Products: web clipper
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news4 stories

Critical Flaw Reported in Popular Evernote Extension for Chrome Users

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2019Exploit / PoC CVE-2019-12592

Flaw in Evernote Web Clipper for Chrome extension allows stealing data

Security AffairsJun 13, 07:29 UTC · Jun 13, 2019Exploit / PoC CVE-2019-12592

Evernote patches flaw potentially affecting 4.6 million users of Google Chrome extension

CyberScoopJun 12, 13:00 UTC · Jun 12, 2019Vulnerability in the wildCVE-2019-12592

Evernote Chrome extension flaw could have allowed access to personal info

Help Net SecurityJun 13, 00:00 UTC · Jun 13, 2019Vulnerability CVE-2019-12592