GitHub Advisoryadvisory · npm

GHSA-h97g-4mx7-5p2p Open Redirect in apostrophe

MEDIUM Published 2020-09-03 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
apostrophe
Severity
Moderate
Weaknesses
CWE-601
Reviewed
2020-08-31

Affected packages

• npm apostrophe: < 2.92.0 → fixed in 2.92.0

Description

Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end. Recommendation Update to version 2.92.0 or later.

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References