HOMEVULNERABILITIESCVE-2024-55630
MEDIUM

CVE-2024-55630

CWE-20Published: February 7, 2025· Updated: Jun 17, 2026

5.5
CVSS v3.1

Official Description

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

NVD Source

Technical Analysis

CVE-2024-55630 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.5.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.None
User InteractionRequired
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected Vendors & Products

joplin_project1 product(s)
joplin
Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/laurent22/joplin/commit/e70efcbd60ce62f06e77c183b362c74e636c02d9
ADVISORYhttps://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffh
ADVISORYhttps://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffh

All References (4)

→
https://en.wikipedia.org/wiki/DOM_clobberingNot Applicable
→
https://github.com/laurent22/joplin/commit/e70efcbd60ce62f06e77c183b362c74e636c02d9Patch
→
https://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffhExploit · Vendor Advisory
→
https://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffhExploit · Vendor Advisory

Quick Facts

CVE IDCVE-2024-55630
CVSS Score5.5 / 10
SeverityMEDIUM
WeaknessCWE-20
CISA KEVNo
Affected1 vendor(s)
PublishedFeb 7, 2025

Related CVEs (CWE-20)

CVE-2020-12389
10.0
CVE-2025-23202
10.0
CVE-2020-6962
10.0
CVE-2020-12388
10.0
CVE-2009-0545
10.0
CVE-2025-34060
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2024-55630 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2024-55630·NVD