Quick answers
- Is CVE-2020-15930 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-15930 being exploited in the wild.
- How severe is CVE-2020-15930?
- Low severity, with a CVSS score of 3.1, published 7 May 2021.
- Which products and versions are affected?
- Joplin 1.0.190 to 1.1.6.
- Is there a fix for CVE-2020-15930?
- A patch was published on 2021-05-07: Advisory published; fix available in version 1.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-15930 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-15930?
- Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw classified as CWE-79 in Joplin's desktop application. The vulnerable component improperly sanitizes HTML embed tags in note content, allowing arbitrary code injection. Attack requires user interaction (opening a malicious note), but no authentication is needed beyond the user having access to Joplin. An attacker can execute arbitrary JavaScript code in the context of the Joplin application, potentially leading to code execution on the victim's system. The vulnerability was fixed in version 1.1.7, with the affected range being 1.0.190 through 1.1.6.
Affected products
- Joplin Joplin 1.0.190 to 1.1.6
Identifiers
- CVE-2020-15930
- GHSA-cgc7-mwp4-3ccx
Timeline
- 2020-09-24: disclosed: Vulnerability published on NVD
- 2021-05-07: patched: Advisory published; fix available in version 1.1.7