CVE-2024-40643
Critical
Description
Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.
SeverityCritical
CVSS9.6
Exploit probability—
ProductJoplin
PublishedSep 9, 2024
First seenSep 9, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- joplin_project joplin3.0.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joplin_project joplin | v < 3.0.15 | 3.0.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.