PT-2023-4625 · Joplin · Joplin

Ryotak · Published 2023-06-30 · Updated 2023-07-06 · CVE-2023-37299

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 2.11.5

Description The issue is related to an AREA element of an image map, which allows for a cross-site scripting (XSS) attack. This can be exploited by a remote attacker to conduct an XSS attack. The vulnerability is associated with the failure to protect the structure of a web page.

Recommendations For versions prior to 2.11.5, update to version 2.11.5 or later to resolve the issue. As a temporary workaround, consider disabling the use of AREA elements in image maps until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05032

CVE-2023-37299

GHSA-4JJV-P8X9-RRF7

Affected Products

Joplin

References · 11

• https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071 · Patch
• https://bdu.fstec.ru/vul/2023-05032 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37299 · Security Note
• https://osv.dev/vulnerability/GHSA-4jjv-p8x9-rrf7 · Vendor Advisory
• https://github.com/laurent22/joplin · Note
• https://github.com/laurent22/joplin/releases/tag/v2.11.5 · Note
• https://t.me/cibsecurity/65794 · Telegram Post
• https://vuln.ryotak.net/advisories/68 · Note
• https://t.me/cvenotify/53802 · Telegram Post
• https://vuldb.com/pt/?id.232808 · Note