PT-2021-15519 · Joplin · Joplin

Laurent Cozic · Published 2021-08-24 · Updated 2021-09-02 · CVE-2021-23431

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions joplin versions prior to 2.3.2

Description The issue is related to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. This means that an attacker could potentially trick a user into performing unintended actions on a web application.

Recommendations For versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-23431

GHSA-GJWP-7V3G-99PJ

SNYK-JS-JOPLIN-1325537

Affected Products

Joplin

References · 10

• https://github.com/laurent22/joplin/commit/19b45de2981c09f6f387498ef96d32b4811eba5e · Patch
• https://snyk.io/vuln/SNYK-JS-JOPLIN-1325537 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23431 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23431 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gjwp-7v3g-99pj · Vendor Advisory
• https://github.com/laurent22/joplin · Note
• https://t.me/cibsecurity/27755 · Telegram Post
• https://t.me/cvenotify/20413 · Telegram Post
• https://t.me/cvenotify/19971 · Telegram Post
• https://t.me/cvenotify/19975 · Telegram Post