CVE-2023-39517 Vulnerability Details

/ / /

CVE-2023-39517 Metadata Quick Info

CVE Published: 21/06/2024 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: GitHub_M | Vendor: laurent22 | Product: joplin
Status : PUBLISHED

CVE-2023-39517 Description

Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer (`packages/renderer/htmlUtils.ts::sanitizeHtml`) preserves `` `` links. However, unlike `` links, the `target` and `href` attributes are not removed. Additionally, because the note preview pane isn\'t sandboxed to prevent top navigation, links with `target` set to `_top` can replace the toplevel electron page. Because any toplevel electron page, with Joplin\'s setup, has access to `require` and can require node libraries, a malicious replacement toplevel page can import `child_process` and execute arbitrary shell commands. This issue has been fixed in commit 7c52c3e9a81a52ef1b42a951f9deb9d378d59b0f which is included in release version 2.12.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS Version: 3.1 | Base Score: 8.2 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

l➤ Exploitability Metrics:
Attack Vector (AV)* NETWORK
Attack Complexity (AC)* LOW
Privileges Required (PR)* LOW
User Interaction (UI)* REQUIRED
Scope (S)* CHANGED

l➤ Impact Metrics:
Confidentiality Impact (C)* HIGH
Integrity Impact (I)* LOW
Availability Impact (A)* LOW

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: CWE-79: Improper Neutralization of Input During Web Page Generation ( Cross-site Scripting )
Source: laurent22

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:

Source: NVD (National Vulnerability Database).

Last added CVEs
▸ CVE-2024-9999 ◂ Discovered: 12/11/2024 Status: PUBLISHED	▸ CVE-2024-9997 ◂ Discovered: 29/10/2024 Status: PUBLISHED	▸ CVE-2024-9996 ◂ Discovered: 29/10/2024 Status: PUBLISHED

Tags:
CVE-2023-39517 Vulnerability Details