Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-40643

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.

Published

2024-09-09T15:15:11.597

Last Modified

2024-09-17T18:03:05.080

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.6 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-79
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application joplin_project joplin < 3.0.15 Yes
References