Quick answers
- Is CVE-2020-9038 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-9038 being exploited in the wild.
- How severe is CVE-2020-9038?
- Low severity, with a CVSS score of 3.1, published 13 October 2020.
- Which products and versions are affected?
- Joplin through 1.0.184.
- Is there a fix for CVE-2020-9038?
- A patch was published on 2020-02-13: Security fix committed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-9038 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-9038?
- Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in Joplin's Markdown-to-HTML rendering pipeline, specifically in the HTML sanitization rules. The vulnerability exists in versions up to 1.0.184 and was patched in version 1.2.1. An authenticated user or attacker with the ability to craft a malicious note containing specially crafted HTML/script content can exploit insufficient input sanitization in the MdToHtml rendering component. The attack requires user interaction (rendering a malicious note) and leverages the presence of renderer context, allowing arbitrary file read via injected JavaScript. A patch was committed on 2020-02-13 and released as part of version 1.2.1.
Affected products
- Joplin Joplin through 1.0.184
Identifiers
- CVE-2020-9038
- GHSA-6r7x-hc8m-985r
Timeline
- 2020-02-17: disclosed
- 2020-02-13: patched: Security fix committed
- 2020-10-13: advisory: GitHub advisory published