Russian Vulnerability Scanner Database

Back to List

CVE-2023-38506

Scores

EPSS

0.000none0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

5.4medium3.x
0246810

CVSS Score: 5.4/10

All CVSS Scores

CVSS 3.x
5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized (or not sanitized properly). As such, the onload attribute of pasted images can execute arbitrary code. Because the TinyMCE editor frame does not use the sandbox attribute, such scripts can access NodeJS’s require through the top variable. From this, an attacker can run arbitrary commands. This issue has been addressed in version 2.12.10 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

anchore_overridesdebiannvd

CWEs

CWE-79

Vulnerable Software (3)

Type: Configuration

Operating System:

Trait: 
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:joplin_project:\\@joplin\\/app-desktop:*:*:*:*:*:node.js:*:*",          "versionEndExcluding": "2.12.10"      ...

Source: anchore_overrides

Type: Configuration

Product: joplin

Operating System: debian

Trait: 
{  "unfixed": true}

Source: debian

Type: Configuration

Vendor: joplin_project

Product: joplin

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*",      "versionEndExcluding": "2.12.10",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd