CVE-2019-12592 describes a universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension for Chrome, affecting versions prior to 7.11.1. This medium-severity flaw (CVSS 6.1) allows remote attackers to execute arbitrary web script or HTML within the context of any loaded third-party IFrame, potentially leading to information disclosure and limited integrity impact. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community attention with 3 mentions and 3 media articles, indicating awareness of its potential impact on millions of users.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.11.1CPE matchmatch criteria | cpe:2.3:a:evernote:web_clipper:*:*:*:*:*:chrome:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.