Chainnpm:joplin
joplin: successive fixes (2020–2023)
7 CVEs over 5 generations, 17 Feb 2020 to 30 Jun 2023.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2020-903817 Feb 2020 First in the chain
- CVE-2020-282496 Nov 2020 related to CVE-2020-9038
- CVE-2021-379162 Aug 2021 No direct link to an earlier CVE
- CVE-2022-233408 Feb 2022 related to CVE-2020-9038related to CVE-2021-37916
- CVE-2021-3329516 Jun 2022 related to CVE-2021-37916related to CVE-2022-23340and 1 more
- CVE-2023-3729830 Jun 2023 related to CVE-2021-37916related to CVE-2022-23340and 1 more
- CVE-2023-3729930 Jun 2023 related to CVE-2021-37916related to CVE-2022-23340and 2 more
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2020-9038 | 17 Feb 2020 | Joplin through 1.0.184 allows Arbitrary File Read via XSS · fixed in 1.2.1 | First in chain | 22.9 |
| CVE-2020-28249 | 6 Nov 2020 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note · fixed in 1.3.11 | CVE-2020-9038 · related · High | 22.5 |
| CVE-2021-37916 | 2 Aug 2021 | Joplin before 2.0.9 allows XSS via button and form in the note body · fixed in 2.0.9 | First in chain | 10.9 |
| CVE-2022-23340 | 8 Feb 2022 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results · fixed in 2.7.1 | CVE-2020-9038 · related · Medium | 14.9 |
| CVE-2021-33295 | 16 Jun 2022 | Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code… · fixed in 1.8.5 | CVE-2021-37916 · related · Medium | 11.6 |
| CVE-2023-37298 | 30 Jun 2023 | Joplin before 2.11.5 allows XSS via a USE element in an SVG document · fixed in 2.11.5 | CVE-2021-37916 · related · Medium | 9.5 |
| CVE-2023-37299 | 30 Jun 2023 | Joplin before 2.11.5 allows XSS via an AREA element of an image map · fixed in 2.11.5 | CVE-2021-37916 · related · Medium | 9.5 |