PatchTheCVEobsidian vulnerabilities and fixes
Recent CVEs affecting obsidian, with upgrade or downgrade steps. 5 tracked.
obsidian has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2023-08-19. Highest priority: CVE-2022-36450 (score 57/100).
- CVE-2023-33244 HIGH 8.2 UPGRADE Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notif
- CVE-2023-2110 HIGH 8.2 UPGRADE Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage t
- CVE-2023-24044 MEDIUM 6.1 UPGRADE A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect
- CVE-2022-45130 MEDIUM 6.5 MITIGATE Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password
- CVE-2022-36450 HIGH 8.0 UPGRADE Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because wind
FAQ
How do I fix obsidian vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is obsidian being exploited right now?
None of the tracked obsidian CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which obsidian CVE should I patch first?
CVE-2022-36450 currently ranks highest (57/100): Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because wind.