Is CVE-2020-28249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-28249 being exploited in the wild.

How severe is CVE-2020-28249?

Low severity, with a CVSS score of 3.1, published 10 May 2021.

Which products and versions are affected?

joplin (npm) SEMVER:introduced=0,fixed=1.3.11.

Is there a fix for CVE-2020-28249?

Yes. joplin (npm): upgrade to 1.3.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-28249 attacked?

It is attacked over the network.

Am I affected by CVE-2020-28249?

Check whether you run joplin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-28249: Joplin cross-site scripting via LINK element

CVE-2020-28249 · Severity: low · CVSS 3.1 · Published 2021-05-10

Joplin is a popular open-source note-taking application that allows users to create and organize notes across multiple devices. An attacker can inject malicious JavaScript code into a note by embedding it within a LINK HTML element, which is then executed when the note is rendered, potentially allowing the attacker to steal user data or impersonate the user within the application.

Technologies: joplin (npm). Vendors: npm.

Quick answers

Is CVE-2020-28249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-28249 being exploited in the wild.
How severe is CVE-2020-28249?: Low severity, with a CVSS score of 3.1, published 10 May 2021.
Which products and versions are affected?: joplin (npm) SEMVER:introduced=0,fixed=1.3.11.
Is there a fix for CVE-2020-28249?: Yes. joplin (npm): upgrade to 1.3.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-28249 attacked?: It is attacked over the network.
Am I affected by CVE-2020-28249?: Check whether you run joplin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

joplin (npm): upgrade to 1.3.11 or later
```
npm install joplin@1.3.11
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) caused by insufficient sanitization of HTML tags in note content. Specifically, the LINK and META tags are not properly filtered before rendering notes in the user interface. An attacker can craft a malicious note containing a LINK tag with JavaScript code (e.g., via event handlers or href attributes pointing to javascript: URIs), and when any user views that note, the script executes in their browser context with their privileges. The attack requires user interaction (opening/viewing the note) but no authentication bypass. The fix, released in version 1.3.11, removes LINK and META tags from note HTML during rendering to prevent XSS.

Affected products

Joplin Project Joplin all versions before 1.3.11

Identifiers

CVE-2020-28249
GHSA-q26w-wjj2-22vv

Timeline

2020-11-06: disclosed
2021-05-10: patched: fix released in Joplin 1.3.11

References

https://github.com/laurent22/joplin/commit/fd90a490c0e5cacd17bfe0ffc422be1d2a9b1c13

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.