Cross-site Request Forgery (CSRF) in joplin

Description

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.

Recommendation

Update the joplin package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.2
• Patched version(s): 2.3.2

References

• GHSA-gjwp-7v3g-99pj
• snyk.io
• CVE-2021-23431
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability - CVE-2023-45884
• Cross-Site Request Forgery (CSRF) in Auth0 - CVE-2018-6874
• Joplin vulnerable to Cross-site Scripting in notes - CVE-2021-37916
• Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags - CVE-2021-33295

Tags:

npm

joplin