Open Redirect in apostrophe

Description

Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end.

Recommendation

Update the apostrophe package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.92.0
• Patched version(s): 2.92.0

References

• GHSA-h97g-4mx7-5p2p
• snyk.io
• www.npmjs.com
• CWE-601
• OWASP 2021-A1

Related Issues

• DOMPurify Open Redirect vulnerability - CVE-2019-25155
• @okta/oidc-middlewareOpen Redirect vulnerability - CVE-2022-3145
• Open redirect in @auth0/nextjs-auth0 - CVE-2021-43812
• Open Redirect in node-forge - CVE-2022-0122

Tags:

npm

apostrophe