GHSA-4r9c-jghc-cx5m

ghsaUSosv

Cross-site Scripting in apostrophe

view advisory published 2021-11-10Licence: CC-BY-4.0

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-25978US	medium5.4	0.50% (43rd)	—	2021-11-07
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which tr…

references

External citations — patches, advisories, analysis.

https://github.com/apostrophecms/apostrophePACKAGE
https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-25978ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan