Improper Input Validation in sanitize-html
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-26539US | medium5.3 | — | ||
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validatio… | ||||
02
references
External citations — patches, advisories, analysis.
- https://advisory.checkmarx.net/advisory/CX-2021-4308WEB
- https://github.com/apostrophecms/sanitize-htmlPACKAGE
- https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22WEB
- https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1daWEB
- https://github.com/apostrophecms/sanitize-html/pull/458WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-26539ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan