LiveActive security incident?Get immediate response
CVE Record

CVE-2018-18524: Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.

Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A malicious Evernote note could run code when viewed in Present mode on Evernote 6.15 for Windows. That could expose local files and allow command execution on the affected computer. The sources describe an older, client-side issue requiring a victim to open an affected note in a specific mode.

Executive priority

Treat as a high-priority legacy application risk if Evernote 6.15 for Windows remains in use. The business urgency depends on endpoint prevalence and whether users receive or open shared notes. If the version is absent, residual risk is low.

Technical view

CVE-2018-18524 is a stored XSS issue in Evernote 6.15 on Windows, described as an incorrectly repaired vulnerability. The CVE states injected Node.js code can execute under Present mode, enabling file reads and command execution after victim interaction. No CVSS score, CWE, or CPE data is provided in the bundle.

Likely exposure

Exposure appears limited to Evernote 6.15 on Windows, especially users who open shared, imported, or otherwise untrusted notes in Present mode. The bundle does not identify other affected versions, platforms, or enterprise deployment scope.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires a malicious stored note and victim interaction through Present mode. The impact is serious because the described result includes local file access and command execution.

Researcher notes

Evidence is sparse in the CVE bundle: affected product metadata is not normalized, severity is unknown, and no fixed version is named. Analysis should stay anchored to Evernote 6.15 for Windows and the Present mode execution path described by CVE and referenced research.

Mitigation direction

  • Identify and remove Evernote 6.15 for Windows from managed endpoints.
  • Check Evernote’s security update guidance for fixed versions or vendor-recommended remediation.
  • Restrict opening untrusted or externally shared notes in Present mode until remediated.
  • Monitor endpoint controls for suspicious Evernote child processes or unusual file access.
  • Educate users handling shared notes about this specific interaction risk.

Validation and detection

  • Inventory Windows endpoints for Evernote version 6.15.
  • Confirm whether Present mode is used in affected workflows.
  • Review Evernote update status against the vendor security updates page.
  • Check EDR or endpoint logs for unusual Evernote process behavior.
  • Assess exposure from shared, synced, or imported notes from untrusted sources.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-18524 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.