Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-55630— DOM Clobbering leads to temporary DOS in the note viewer in Joplin

Quick assessment

Affected
laurent22 joplin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joplin是Laurent Cozic个人开发者的一款开源的笔记和待办事项应用程序。 Joplin存在输入验证错误漏洞，该漏洞源于Joplin的HTML清理程序中如果指定name属性的值与现有属性的值相同可能导致拒绝服务。

CVSS 3.3 · Low EPSS 0.33% · P24

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-55630

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DOM Clobbering leads to temporary DOS in the note viewer in Joplin
Source: CVE Program / CVE List V5
Vulnerability Description
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Joplin 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Joplin是Laurent Cozic个人开发者的一款开源的笔记和待办事项应用程序。 Joplin存在输入验证错误漏洞，该漏洞源于Joplin的HTML清理程序中如果指定name属性的值与现有属性的值相同可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
laurent22 joplin < 3.2.8 -

II. Public POCs for CVE-2024-55630

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-55630

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-55630 (1)

Vendor Advisories for CVE-2024-55630 (1)

News Coverage for CVE-2024-55630 (1)

Same Patch Batch · laurent22 · 2025-02-07 · 3 CVEs total

CVE-2025-24028 7.8 HIGH Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin
CVE-2025-25187 7.8 HIGH Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin

IV. Related Vulnerabilities

Same product: joplin
Same vendor: laurent22
Same weakness: CWE-20

V. Comments for CVE-2024-55630

No comments yet

Leave a comment