{"id":"CVE-2020-28249","published":"2020-11-06T06:05:55Z","modified":"2024-08-04T16:33:58Z","title":"Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note","vendor":null,"product":null,"tier":"tail","description":{"text":"Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03063,"percentile":0.87585,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/laurent22/joplin/releases","tags":["x_refsource_MISC"]},{"url":"https://github.com/fhlip0/JopinXSS","tags":["x_refsource_MISC"]}],"priority":{"score":22.5,"factors":[{"name":"EPSS percentile","points":17.52},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-11-09"},"first":{"date":"2020-11-09","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/49024"},"provenance":"source"},"affected":[{"ecosystem":"npm","package":"joplin","vulnerableRanges":["<1.3.11"],"patched":["1.3.11"],"from":["GHSA-q26w-wjj2-22vv"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1156","exploited":false,"provenance":"source"},"exploits":[{"id":49024,"url":"https://www.exploit-db.com/exploits/49024","title":"Joplin 1.2.6 - 'link' Cross Site Scripting","date":"2020-11-09","verified":false,"provenance":"source"}],"lineage":{"familyId":"fam-joplin-cve-2020-9038","parents":[{"from":"CVE-2020-9038","to":"CVE-2020-28249","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"1.2.1","toFixed":"1.3.11","daysApart":263},{"kind":"same-code","provenance":"machine","files":["ReactNativeClient/lib/joplin-renderer/htmlUtils.js"],"commits":["https://github.com/laurent22/joplin/commit/fd90a490c0e5cacd17bfe0ffc422be1d2a9b1c13","https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc"],"basis":"shared function","functions":["HtmlUtils"]}]}],"packageHistory":[{"cve":"CVE-2018-1000534","published":"2018-06-26","fixed":"1.0.90","kev":false},{"cve":"CVE-2020-15930","published":"2020-09-24","fixed":"1.1.7","kev":false},{"cve":"CVE-2020-9038","published":"2020-02-17","fixed":"1.2.1","kev":false},{"cve":"CVE-2020-28249","published":"2020-11-06","fixed":"1.3.11","kev":false},{"cve":"CVE-2021-33295","published":"2022-06-16","fixed":"1.8.5","kev":false,"link":{"from":"CVE-2020-28249","to":"CVE-2021-33295","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"1.3.11","toFixed":"1.8.5","daysApart":587}]}},{"cve":"CVE-2021-37916","published":"2021-08-02","fixed":"2.0.9","kev":false},{"cve":"CVE-2021-23431","published":"2021-08-24","fixed":"2.3.2","kev":false}],"package":"npm:joplin"}}