{"id":"CVE-2020-9038","published":"2020-02-17T15:47:29Z","modified":"2024-08-04T10:19:19Z","title":"Joplin through 1.0.184 allows Arbitrary File Read via XSS","vendor":null,"product":null,"tier":"tail","description":{"text":"Joplin through 1.0.184 allows Arbitrary File Read via XSS.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03566,"percentile":0.89352,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc","tags":["x_refsource_MISC"]},{"url":"https://github.com/laurent22/joplin/compare/clipper-1.0.19...clipper-1.0.20","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/156582/Joplin-Desktop-1.0.184-Cross-Site-Scripting.html","tags":["x_refsource_MISC"]}],"priority":{"score":22.9,"factors":[{"name":"EPSS percentile","points":17.87},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-03-02"},"pocGithub":{"count":1,"skipped":0,"earliest":"2020-02-27","earliestUrl":"https://github.com/JavierOlmedo/CVE-2020-9038","repos":[{"name":"JavierOlmedo/CVE-2020-9038","url":"https://github.com/JavierOlmedo/CVE-2020-9038","stars":5,"created":"2020-02-27"}]},"first":{"date":"2020-02-27","source":"PoC-in-GitHub","url":"https://github.com/JavierOlmedo/CVE-2020-9038"},"provenance":"source"},"affected":[{"ecosystem":"npm","package":"joplin","vulnerableRanges":["<1.2.1"],"patched":["1.2.1"],"from":["GHSA-6r7x-hc8m-985r"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-1417","exploited":false,"provenance":"source"},"exploits":[{"id":48147,"url":"https://www.exploit-db.com/exploits/48147","title":"Joplin Desktop 1.0.184 - Cross-Site Scripting","date":"2020-03-02","verified":false,"provenance":"source"}],"exploitRefs":["http://packetstormsecurity.com/files/156582/Joplin-Desktop-1.0.184-Cross-Site-Scripting.html"],"lineage":{"packageHistory":[{"cve":"CVE-2018-1000534","published":"2018-06-26","fixed":"1.0.90","kev":false},{"cve":"CVE-2020-15930","published":"2020-09-24","fixed":"1.1.7","kev":false},{"cve":"CVE-2020-9038","published":"2020-02-17","fixed":"1.2.1","kev":false},{"cve":"CVE-2020-28249","published":"2020-11-06","fixed":"1.3.11","kev":false,"link":{"from":"CVE-2020-9038","to":"CVE-2020-28249","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"1.2.1","toFixed":"1.3.11","daysApart":263}]}},{"cve":"CVE-2021-33295","published":"2022-06-16","fixed":"1.8.5","kev":false},{"cve":"CVE-2021-37916","published":"2021-08-02","fixed":"2.0.9","kev":false}],"package":"npm:joplin"}}