What is CVE-2020-17759?

CVE-2020-17759 is a high-severity vulnerability in Evernote, classified under Command Injection. CVSS score: 8.8/10. Published 2021-06-24.

How severe is CVE-2020-17759?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Evernote

CVE-2020-17759

An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.034 (87.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Evernote — versions 6.17.7, 6.18
Microsoft Windows_10
Microsoft Windows_7
Microsoft Windows_server_2008
N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-17759?: CVE-2020-17759 is a high-severity vulnerability in Evernote, classified under Command Injection. CVSS score: 8.8/10. Published 2021-06-24.
How severe is CVE-2020-17759?: High severity. CVSS v3 base score is 8.8 out of 10.