{"id":"CVE-2021-23431","aliases":["GHSA-gjwp-7v3g-99pj","SNYK-JS-JOPLIN-1325537"],"url":"https://o3.security/vulnerability/CVE-2021-23431","summary":"Cross-site Request Forgery (CSRF) in joplin","details":"The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.","published":"2021-08-24T08:15:22.463Z","modified":"2026-08-07T15:13:52.535644Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"joplin","fixedVersion":"2.3.2"}],"fix":{"url":"https://github.com/laurent22/joplin/commit/19b45de2981c09f6f387498ef96d32b4811eba5e","label":"laurent22/joplin@19b45de"},"references":[{"type":"FIX","url":"https://github.com/laurent22/joplin/commit/19b45de2981c09f6f387498ef96d32b4811eba5e"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JS-JOPLIN-1325537"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T15:13:52.535644Z"}}