Lucene search

GoogleOSV:CVE-2023-37299

HistoryJun 30, 2023 - 3:15 p.m.

CVE-2023-37299

2023-06-3015:15:09

Google

osv.dev

joplin

image map

xss

vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

CPENameOperatorVersion
joplineq1.7.1
joplineqserver-v2.5.7
joplineqserver-v2.0.12
joplineqandroid-v1.0.127
joplineqcli-v1.0.140
joplineqcli-v1.0.97
joplineqcli-v1.0.95
joplineqcli-v2.10.1
joplineqserver-v2.5.6
joplineq1.0.165

Name	Operator	Version
joplin	eq	1.7.1
joplin	eq	server-v2.5.7
joplin	eq	server-v2.0.12
joplin	eq	android-v1.0.127
joplin	eq	cli-v1.0.140
joplin	eq	cli-v1.0.97
joplin	eq	cli-v1.0.95
joplin	eq	cli-v2.10.1
joplin	eq	server-v2.5.6
joplin	eq	1.0.165

Rows per page:

1-10 of 9721

References

github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071

github.com/laurent22/joplin/releases/tag/v2.11.5

vuln.ryotak.net/advisories/68

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

Related for OSV:CVE-2023-37299