CVE-2024-40643 - Joplin has a parsing error leading to Cross-site Scripting (XSS)

Back Back to CVE browser

CRITICAL

Joplin has a parsing error leading to Cross-site Scripting (XSS)

Published Sep 9, 2024

9.7

CRITICAL

CVSS 3.1

EPSS 0.79%

Description

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.

Affected products

Vendor Laurent22 Product Joplin Default
n/a
- Version
  < 3.0.15
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Laurent22

Joplin

n/a

Version	Status	Constraints
< 3.0.15	affected	-

Vendor Joplinapp Product Joplin Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <3.0.15

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Joplinapp

Joplin

n/a

Version	Status	Constraints
0	affected	<3.0.15

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/laurent22/joplin/commit/b220413a9b5ed55fb1f565ac786a5c231da8bc87
x_refsource_MISCPatch
https://github.com/laurent22/joplin/security/advisories/GHSA-g796-3g6g-jmmc
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://github.com/laurent22/joplin/commit/b220413a9b5ed55fb1f565ac786a5c231da8bc87		x_refsource_MISCPatch
https://github.com/laurent22/joplin/security/advisories/GHSA-g796-3g6g-jmmc		x_refsource_CONFIRMExploitVendor Advisory