{"id":"CVE-2023-37299","published":"2023-06-30T00:00:00Z","modified":"2024-11-27T15:29:11Z","title":"Joplin before 2.11.5 allows XSS via an AREA element of an image map","vendor":null,"product":null,"tier":"tail","description":{"text":"Joplin before 2.11.5 allows XSS via an AREA element of an image map.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00574,"percentile":0.47419,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/laurent22/joplin/releases/tag/v2.11.5","tags":[]},{"url":"https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071","tags":[]},{"url":"https://vuln.ryotak.net/advisories/68","tags":[]}],"priority":{"score":9.5,"factors":[{"name":"EPSS percentile","points":9.48}]},"affected":[{"ecosystem":"npm","package":"joplin","vulnerableRanges":["<2.11.5"],"patched":["2.11.5"],"from":["GHSA-4jjv-p8x9-rrf7"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1689","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-35131","published":"2022-07-25","fixed":"2.9.1","kev":false},{"cve":"CVE-2022-45598","published":"2023-01-31","fixed":"2.9.17","kev":false,"link":{"from":"CVE-2022-45598","to":"CVE-2023-37299","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:joplin","fromFixed":"2.9.17","toFixed":"2.11.5","daysApart":150}]}},{"cve":"CVE-2023-37298","published":"2023-06-30","fixed":"2.11.5","kev":false},{"cve":"CVE-2023-37299","published":"2023-06-30","fixed":"2.11.5","kev":false},{"cve":"CVE-2024-49362","published":"2024-11-14","fixed":"3.1.0","kev":false}],"package":"npm:joplin"}}