PT-2022-16160 · Trilium · Trilium

Published 2022-07-10 · Updated 2022-07-15 · CVE-2022-2365

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions trilium versions prior to 0.53.3

Description The issue is related to Cross-site Scripting (XSS) - Stored. This is a type of security vulnerability that occurs when an application stores user input data without proper validation, allowing an attacker to inject malicious scripts into the application. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions prior to 0.53.3, update to version 0.53.3 or later to resolve the issue. As a temporary workaround, consider restricting access to user-input data to minimize the risk of exploitation. Avoid using the application until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2365

Affected Products

Trilium

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2365.json · Exploit
• 🔥 https://huntr.dev/bounties/34b281cd-ff4a-4ab0-ae25-56aef557682f · Exploit
• https://github.com/zadam/trilium/commit/1dfc37704fdd90ab7afbd8a586bdfc5cfaadeb8a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2365 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2365 · Vendor Advisory
• https://t.me/cvenotify/32860 · Telegram Post
• https://t.me/cvenotify/32873 · Telegram Post
• https://t.me/cibsecurity/45872 · Telegram Post