PT-2021-21908 · Joplin · Joplin

Published 2021-08-02 · Updated 2022-05-24 · CVE-2021-37916

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.0.9

Description: The issue allows Cross-site Scripting (XSS) via button and form in the note body.

Recommendations: For versions prior to 2.0.9, update to version 2.0.9 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37916

GHSA-MRMF-755G-W2VW

Affected Products

Joplin

References · 8

• https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37916 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37916 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrmf-755g-w2vw · Vendor Advisory
• https://github.com/laurent22/joplin · Note
• https://github.com/laurent22/joplin/releases/tag/v2.0.9 · Note
• https://t.me/cvenotify/18516 · Telegram Post
• https://t.me/cibsecurity/26728 · Telegram Post