{"id":"CVE-2021-37916","published":"2021-08-02T23:35:37Z","modified":"2024-08-04T01:30:09Z","title":"Joplin before 2.0.9 allows XSS via button and form in the note body","vendor":null,"product":null,"tier":"tail","description":{"text":"Joplin before 2.0.9 allows XSS via button and form in the note body.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00733,"percentile":0.54389,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26","tags":["x_refsource_MISC"]},{"url":"https://github.com/laurent22/joplin/releases/tag/v2.0.9","tags":["x_refsource_MISC"]}],"priority":{"score":10.9,"factors":[{"name":"EPSS percentile","points":10.88}]},"affected":[{"ecosystem":"npm","package":"joplin","vulnerableRanges":["<2.0.9"],"patched":["2.0.9"],"from":["GHSA-mrmf-755g-w2vw"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4621","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-9038","published":"2020-02-17","fixed":"1.2.1","kev":false},{"cve":"CVE-2020-28249","published":"2020-11-06","fixed":"1.3.11","kev":false},{"cve":"CVE-2021-33295","published":"2022-06-16","fixed":"1.8.5","kev":false},{"cve":"CVE-2021-37916","published":"2021-08-02","fixed":"2.0.9","kev":false},{"cve":"CVE-2021-23431","published":"2021-08-24","fixed":"2.3.2","kev":false,"link":{"from":"CVE-2021-37916","to":"CVE-2021-23431","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"2.0.9","toFixed":"2.3.2","daysApart":22}]}},{"cve":"CVE-2022-23340","published":"2022-02-08","fixed":"2.7.1","kev":false},{"cve":"CVE-2022-35131","published":"2022-07-25","fixed":"2.9.1","kev":false}],"package":"npm:joplin"}}