Joplin Cross-site Scripting vulnerability

Description

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

Recommendation

Update the joplin package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.11.5
• Patched version(s): 2.11.5

References

• GHSA-4jjv-p8x9-rrf7
• vuln.ryotak.net
• CVE-2023-37299
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Joplin Cross-site Scripting vulnerability (GHSA-7grw-xfx6-qhx6) - CVE-2023-37298
• Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags - CVE-2021-33295
• Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592
• Vega has Cross-site Scripting vulnerability in `lassoAppend` function - CVE-2023-26487

Tags:

npm

joplin