PT-2020-14723 · Joplin · Joplin

Ademar Nowasky Junior · Published 2020-09-24 · Updated 2021-05-07 · CVE-2020-15930

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Joplin desktop versions 1.0.190 through 1.0.245

Description The issue allows for arbitrary code execution via a malicious HTML embed tag. This is an XSS issue that affects Joplin desktop, enabling potential attackers to execute arbitrary code.

Recommendations For versions 1.0.190 through 1.0.245, update to a version outside of this range to mitigate the risk of arbitrary code execution. As a temporary workaround, consider restricting the use of HTML embed tags in Joplin desktop until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15930

GHSA-CGC7-MWP4-3CCX

Affected Products

Joplin

References · 8

• 🔥 http://packetstormsecurity.com/files/159316/Joplin-1.0.245-Cross-Site-Scripting-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48837 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15930 · Security Note
• https://osv.dev/vulnerability/GHSA-cgc7-mwp4-3ccx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15930 · Vendor Advisory
• https://github.com/laurent22/joplin/releases/tag/v1.1.4 · Note
• https://github.com/laurent22/joplin/issues/3552 · Note
• https://github.com/laurent22/joplin/commit/57d750bc9aeb0f98d53ed4b924458b54984c15ff · Note