Description

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

Remediation

References

https://github.com/laurent22/joplin/releases

https://github.com/fhlip0/JopinXSS

Related Vulnerabilities

CVE-2019-1003052 Vulnerability in maven package org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin

CVE-2017-18640 Vulnerability in maven package org.yaml:snakeyaml

CVE-2022-25883 Vulnerability in maven package org.webjars.npm:semver

CVE-2016-4055 Vulnerability in maven package org.webjars.bower:moment

CVE-2016-0706 Vulnerability in maven package org.apache.tomcat:catalina

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory Exploit