Quick answers
- Is CVE-2021-23431 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23431 being exploited in the wild.
- How severe is CVE-2021-23431?
- Low severity, with a CVSS score of 3.1, published 2 September 2021.
- Which products and versions are affected?
- Joplin before 2.3.2.
- Is there a fix for CVE-2021-23431?
- A patch was published on 2021-08-25: Fix committed on 2021-07-24, prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-23431 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-23431?
- Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Joplin before version 2.3.2 was vulnerable to cross-site request forgery (CSRF) attacks due to missing CSRF tokens in various form handlers. An attacker could craft a malicious webpage or email that, when visited by an authenticated Joplin user, would trigger unprotected form submissions on the Joplin server. This requires user interaction (visiting the malicious page) and the victim to be logged into Joplin. The fix involved adding form tokens (CSRF tokens) to prevent these attacks, as demonstrated in commit 19b45de. The vulnerability was patched in version 2.3.2.
Affected products
- Joplin Joplin before 2.3.2
Identifiers
- CVE-2021-23431
- GHSA-gjwp-7v3g-99pj
Timeline
- 2021-09-02: disclosed
- 2021-08-25: patched: Fix committed on 2021-07-24, prior to public disclosure