CVE-2021-37916: XSS
Joplin before 2.0.9 allows Cross-site Scripting via button and form in the note body.
Other sources
Joplin before 2.0.9 allows XSS via button and form in the note body.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/joplinto a version that resolves this vulnerability.Fixed in 2.0.9
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37916?
CVE-2021-37916 is classified as a medium severity vulnerability due to its potential for Cross-site Scripting attacks.
How do I fix CVE-2021-37916?
To fix CVE-2021-37916, users should upgrade Joplin to version 2.0.9 or later.
What type of vulnerability is CVE-2021-37916?
CVE-2021-37916 is a Cross-site Scripting (XSS) vulnerability affecting Joplin before version 2.0.9.
What are the risks of CVE-2021-37916?
CVE-2021-37916 can allow attackers to execute malicious scripts in the context of the user's session, potentially compromising sensitive data.
Which versions of Joplin are affected by CVE-2021-37916?
CVE-2021-37916 affects all versions of Joplin prior to version 2.0.9.