#VU103728 Input validation error in Joplin - CVE-2024-55630

Vulnerability identifier: #VU103728

Vulnerability risk: Low

CVSSv4.0: 1.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2024-55630

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Joplin
Client/Desktop applications / Software for archiving

Vendor: Joplinapp

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the name attribute in the note viewer. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Joplin: 3.2.1 - 3.2.3

---

External links
https://en.wikipedia.org/wiki/DOM_clobbering
https://github.com/laurent22/joplin/commit/e70efcbd60ce62f06e77c183b362c74e636c02d9
https://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffh

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.