CVE-2022-40277

{"containers": {"cna": {"affected": [{"product": "Joplin", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.8.8"}]}], "descriptions": [{"lang": "en", "value": "Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function."}], "problemTypes": [{"descriptions": [{"description": "Remote command execution (RCE)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-30T16:20:59.000Z", "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://fluidattacks.com/advisories/skrillex/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/laurent22/joplin"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "help@fluidattacks.com", "ID": "CVE-2022-40277", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Joplin", "version": {"version_data": [{"version_value": "2.8.8"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote command execution (RCE)"}]}]}, "references": {"reference_data": [{"name": "https://fluidattacks.com/advisories/skrillex/", "refsource": "MISC", "url": "https://fluidattacks.com/advisories/skrillex/"}, {"name": "https://github.com/laurent22/joplin", "refsource": "MISC", "url": "https://github.com/laurent22/joplin"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:14:40.043Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://fluidattacks.com/advisories/skrillex/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/laurent22/joplin"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T18:31:53.263263Z", "id": "CVE-2022-40277", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T18:32:21.014Z"}}]}, "cveMetadata": {"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "assignerShortName": "Fluid Attacks", "cveId": "CVE-2022-40277", "datePublished": "2022-09-30T16:20:59.000Z", "dateReserved": "2022-09-08T00:00:00.000Z", "dateUpdated": "2025-05-20T18:32:21.014Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fluidattacks.com/advisories/skrillex/", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/laurent22/joplin", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:14:40.043Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-40277", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-20T18:31:53.263263Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T18:31:49.398Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "Joplin", "versions": [{"status": "affected", "version": "2.8.8"}]}], "references": [{"url": "https://fluidattacks.com/advisories/skrillex/", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/laurent22/joplin", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Remote command execution (RCE)"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2022-09-30T16:20:59.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.8.8"}]}, "product_name": "Joplin"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://fluidattacks.com/advisories/skrillex/", "name": "https://fluidattacks.com/advisories/skrillex/", "refsource": "MISC"}, {"url": "https://github.com/laurent22/joplin", "name": "https://github.com/laurent22/joplin", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote command execution (RCE)"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-40277", "STATE": "PUBLIC", "ASSIGNER": "help@fluidattacks.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-40277", "state": "PUBLISHED", "dateUpdated": "2025-05-20T18:32:21.014Z", "dateReserved": "2022-09-08T00:00:00.000Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2022-09-30T16:20:59.000Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Joplin", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.8.8"}]}], "source": "help@fluidattacks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*", "matchCriteriaId": "91B75E51-3827-4240-9060-F261E9113717", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*", "matchCriteriaId": "91B75E51-3827-4240-9060-F261E9113717", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:-:*:*:*", "matchCriteriaId": "652F5027-4436-458C-84FD-7AD89B489BAA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function."}, {"lang": "es", "value": "Joplin versi\u00f3n 2.8.8, permite a un atacante externo ejecutar comandos arbitrarios de forma remota en cualquier cliente que abra un enlace en un archivo markdown malicioso, por medio de Joplin. Esto es posible porque la aplicaci\u00f3n no comprueba apropiadamente el esquema/protocolo de los enlaces existentes en el archivo markdown antes de pasarlos a la funci\u00f3n \"shell.openExternal\""}], "id": "CVE-2022-40277", "lastModified": "2026-06-17T05:01:13.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-40277", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-05-20T18:31:53.263263Z", "version": "2.0.3"}}]}, "published": "2022-09-30T17:15:13.277", "references": [{"source": "help@fluidattacks.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/skrillex/"}, {"source": "help@fluidattacks.com", "tags": ["Product"], "url": "https://github.com/laurent22/joplin"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/skrillex/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/laurent22/joplin"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}