GitHub Advisoryadvisory · npm

GHSA-4r9c-jghc-cx5m Cross-site Scripting in apostrophe

MEDIUM Published 2021-11-10 Modified 2021-11-08 Official page ↗
Aliases
CVE-2021-25978
Ecosystem
npm
Packages
apostrophe
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-11-08

Affected packages

• npm apostrophe: >= 2.63.0, < 3.4.0 → fixed in 3.4.0

Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

Related

Alias · CVE (1)

  • CVE-2021-25978 Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References