Cross-site Scripting in apostrophe

Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

Recommendation

Update the apostrophe package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.63.0, < 3.4.0
• Patched version(s): 3.4.0

References

• GHSA-4r9c-jghc-cx5m
• CVE-2021-25978
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DOMpurify has a nesting-based mXSS - CVE-2024-47875
• Path Traversal in simplehttpserver - CVE-2018-16478
• Cross-Site Scripting in html-pages - CVE-2018-16481
• Path Traversal in http-server-node - CVE-2021-23797

Tags:

npm

apostrophe