CVE-2021-33295
MEDIUMCVSS 5.4/10EPSS 0.79%
Last modified
CVE-2021-33295 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.. EPSS estimates a 0.79% chance of exploitation in the next 30 days.
Description
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Joplin Project | Joplin | < 1.8.5 |
References
- https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adfPatch, Third Party Advisory
- https://github.com/laurent22/joplin/releases/tag/v1.8.5Release Notes, Third Party Advisory
- https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.htmlExploit, Third Party Advisory
- https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adfPatch, Third Party Advisory
- https://github.com/laurent22/joplin/releases/tag/v1.8.5Release Notes, Third Party Advisory
- https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-33295?
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
How severe is CVE-2021-33295?
CVE-2021-33295 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 0.79% probability of exploitation in the next 30 days.
How do I fix CVE-2021-33295?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-33286In NTFS-3G versions < 2021.8.22, when a specially crafted un…7.8
- CVE-2021-33287In NTFS-3G versions < 2021.8.22, when specially crafted NTFS…7.8
- CVE-2021-33289In NTFS-3G versions < 2021.8.22, when a specially crafted MF…7.8
- CVE-2021-3329Lack of proper validation in HCI Host stack initialization c…6.5
- CVE-2021-33293Panorama Tools libpano13 v2.9.20 was discovered to contain a…9.1
- CVE-2021-33294In elfutils 0.183, an infinite loop was found in the functio…5.5
- CVE-2021-3330RCE/DOS: Linked-list corruption leading to large out-of-boun…8.8
- CVE-2021-33304Double Free vulnerability in virtualsquare picoTCP v1.7.0 an…9.8
- CVE-2021-3331WinSCP before 5.17.10 allows remote attackers to execute arb…9.8
- CVE-2021-33315The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.…9.8
- CVE-2021-33316The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.…9.8
- CVE-2021-33317The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.…7.5
Are you affected by CVE-2021-33295?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST