PT-2025-6009 · Joplin · Joplin

Personalizedrefrigerator · Published 2025-02-07 · Updated 2025-02-10 · CVE-2024-55630

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.2.8

Description Joplin is a free, open source note taking and to-do application. The HTML sanitizer in Joplin allows the name attribute to be specified, which can lead to a property replacement issue. If the name attribute is set to the same value as an existing document property, that property is replaced with the element. This issue can cause a denial of service, where the note viewer fails to refresh until closed and re-opened with a different note.

Recommendations For versions prior to 3.2.8, upgrade to version 3.2.8 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the name attribute in the HTML sanitizer until a patch is applied. There are no known workarounds for this vulnerability.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-55630

GHSA-5CCH-JR52-QFFH

Affected Products

Joplin

References · 11

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55630.json · Exploit
• https://github.com/laurent22/joplin/commit/e70efcbd60ce62f06e77c183b362c74e636c02d9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-55630 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55630 · Vendor Advisory
• https://twitter.com/CVEnew/status/1887995122614215133 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1888018548565344591 · Twitter Post
• https://twitter.com/cybercronai/status/1888340859755589934 · Twitter Post
• https://twitter.com/bluepinksec/status/1888845607084708090 · Twitter Post
• https://en.wikipedia.org/wiki/DOM_clobbering · Note
• https://t.me/cvedetector/17533 · Telegram Post