{"id":"CVE-2023-37298","published":"2023-06-30T00:00:00Z","modified":"2024-11-27T15:30:00Z","title":"Joplin before 2.11.5 allows XSS via a USE element in an SVG document","vendor":null,"product":null,"tier":"tail","description":{"text":"Joplin before 2.11.5 allows XSS via a USE element in an SVG document.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00574,"percentile":0.47419,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/laurent22/joplin/releases/tag/v2.11.5","tags":[]},{"url":"https://github.com/laurent22/joplin/commit/caf66068bfc474bbfd505013076ed173cd90ca83","tags":[]},{"url":"https://vuln.ryotak.net/advisories/69","tags":[]}],"priority":{"score":9.5,"factors":[{"name":"EPSS percentile","points":9.48}]},"affected":[{"ecosystem":"npm","package":"joplin","vulnerableRanges":["<2.11.5"],"patched":["2.11.5"],"from":["GHSA-7grw-xfx6-qhx6"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1732","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-23340","published":"2022-02-08","fixed":"2.7.1","kev":false},{"cve":"CVE-2022-35131","published":"2022-07-25","fixed":"2.9.1","kev":false},{"cve":"CVE-2022-45598","published":"2023-01-31","fixed":"2.9.17","kev":false,"link":{"from":"CVE-2022-45598","to":"CVE-2023-37298","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"2.9.17","toFixed":"2.11.5","daysApart":150}]}},{"cve":"CVE-2023-37298","published":"2023-06-30","fixed":"2.11.5","kev":false},{"cve":"CVE-2023-37299","published":"2023-06-30","fixed":"2.11.5","kev":false},{"cve":"CVE-2024-49362","published":"2024-11-14","fixed":"3.1.0","kev":false}],"package":"npm:joplin"}}