CVE-2024-55630CWE-20

DOM Clobbering leads to temporary DOS in the note viewer in Joplin

Low · published February 7, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-02-07T22:23Z
EPSS history
Timeline
  • 07 FEB 22:23Z
    DOM Clobbering leads to temporary DOS in the note viewer in Joplin
    cvelistv5